CVE-2026-77074: n8n before 1.123.69 SSRF via Edit Image Node
n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access local files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8n (Edit Image Node: Draw Text)to a version that resolves this vulnerability.Fixed in 1.123.69
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to n8n and able to use the Edit Image node's Draw Text operation. The issue is therefore most relevant where untrusted or low-privileged users can create or modify workflows containing that operation.
What could an attacker reach through the vulnerable node?
Crafted text values can cause blind outbound HTTP requests to arbitrary addresses. They may also be used to access local files from the n8n server environment.
Which deployments are affected?
n8n versions earlier than 1.123.69 are affected when the Edit Image node's Draw Text operation is available to an authenticated user. The provided information does not establish whether a particular default workflow or configuration invokes the vulnerable operation.
How can I determine whether I may be exposed?
Check whether the n8n instance runs a version before 1.123.69 and whether authenticated users can create or edit workflows using the Edit Image node's Draw Text operation. Review workflows and permissions for users who could supply attacker-controlled Draw Text values.