Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-85172n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass

Medium 5.3

In plain English

A medium-severity server-side request forgery in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 82.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	2.34.0 – before 2.34.1
n8n-io	n8n	0 – before 2.33.4

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

GitHub Security Advisory (GHSA-jp9j-jr97-w9pj) vendor-advisory
VulnCheck Advisory: n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass third-party-advisory