CVE-2026-77085: n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool
n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an authenticated user with permission to create SearXNG credentials and configure a personal agent could set the API URL to an internal host, causing the n8n server to connect to that host and return the response content through the Agent chat output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.34.1 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.33.4
Event History
Frequently Asked Questions
Which n8n versions include the fix?
The issue is fixed in n8n 2.34.1 and in the 2.33 release line starting with 2.33.4. Versions before 2.34.1, and 2.33.x versions before 2.33.4, are affected.
Does enabling N8N_SSRF_PROTECTION_ENABLED prevent this attack?
No. The vulnerable SearXNG Agent tool used a raw HTTP client that bypassed n8n's centralized SSRF protection, including when N8N_SSRF_PROTECTION_ENABLED=true.
What access does an attacker need?
An attacker must be authenticated and have permission to create SearXNG credentials and configure a personal agent. They can then supply an internal-host URL as the SearXNG API URL.
What can an attacker obtain through successful exploitation?
The n8n server can be induced to connect to an internal host, and the response content is returned through the Agent chat output.