CVE-2026-65593: n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters
Impact
Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required.
By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL, defeating the restriction meant to confine requests to the node's own upstream service. With SSRF protection disabled by default (N8NSSRFPROTECTIONENABLED=false), this let an authenticated user make the n8n server issue HTTP requests to arbitrary internal targets.
Patches The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to this version or later to remediate the vulnerability.
Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Set N8NSSRFPROTECTIONENABLED=true to enable SSRF filtering for private IP ranges and cloud metadata endpoints. - Restrict network egress from the n8n host to limit reachable internal services.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.29.8 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.30.1 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.64 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.64 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.29.8 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.30.1 - Configuration
Set N8N_SSRF_PROTECTION_ENABLED=true to enable SSRF filtering for private IP ranges and cloud metadata endpoints.
n8n N8N_SSRF_PROTECTION_ENABLED = true - Compensating control
Restrict n8n instance access to fully trusted users only.
- Compensating control
Restrict network egress from the n8n host to limit reachable internal services.
- Compensating control
Ensure the /rest/dynamic-node-parameters/ endpoints are not reachable by untrusted authenticated users (they lacked authorization scopes, so restrict access accordingly).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65593?
CVE-2026-65593 has a medium severity rating of 6.3 based on the CVSS v3.1 metrics.
How do I fix CVE-2026-65593?
To mitigate CVE-2026-65593, upgrade to n8n versions 1.123.64, 2.29.8, or 2.30.1 where the SSRF vulnerability is addressed.
What type of vulnerability is associated with CVE-2026-65593?
CVE-2026-65593 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Who is affected by CVE-2026-65593?
Any authenticated user of n8n prior to versions 1.123.64, 2.29.8, and 2.30.1 can exploit CVE-2026-65593.
What impact does CVE-2026-65593 have?
CVE-2026-65593 allows an authenticated user to access unauthorized endpoints and potentially manipulate routing configurations.