Al1Z4Deh

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.64 **Description** Authenticated attackers can perform server-side request forgery (SSRF) via the `/rest/dynamic-node-parameters/` endpoints, which lack authorization scopes. By providing absolute URLs in the routing configuration, a user can override the `baseURL` restrictions of a node type. When the `N8N SSRF PROTECTION ENABLED` variable is set to `false`, the server can be forced to issue HTTP requests to arbitrary internal targets. **Recommendations** Update to version 1.123.64 or later. Set `N8N SSRF PROTECTION ENABLED=true` to enable filtering for private IP ranges and cloud metadata endpoints. Restrict n8n instance access to fully trusted users only. Restrict network egress from the n8n host to limit reachable internal services.