CVE-2026-77069

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1

Description An SSRF (Server-Side Request Forgery) protection bypass exists during the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests utilize a protected HTTP client, the token exchange process employs a separate client lacking SSRF guards. A user with credential-creation permissions can configure the access-token URL to point to an internal address. By completing the OAuth2 flow, the system sends a fixed-shape token-exchange POST request to the target and reflects the response body back to the attacker.

Recommendations Update to version 1.123.69 or later. Update to version 2.33.4 or later. Update to version 2.34.1 or later.