CVE-2026-86082: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8n OpenAI Chat Model node (LMChatOpenAi/loadModels.ts)to a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8n OpenAI Chat Model node (LMChatOpenAi/loadModels.ts)to a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8n OpenAI Chat Model node (LMChatOpenAi/loadModels.ts)to a version that resolves this vulnerability.Fixed in 2.38.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A workflow editor who can configure an OpenAI Chat Model node and use an OpenAI API credential can set options.baseURL to an arbitrary host. The vulnerable model-search dropdown path can then send that credential to the selected host.
Are normal OpenAI Chat Model requests affected?
The allowed-domain restriction was enforced for normal calls. The bypass was limited to the model-search dropdown path, implemented by searchModels in loadModels.ts.
Which versions contain the fix?
The issue is fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Versions prior to those releases are affected.
What can be done if upgrading is not immediately possible?
Restrict workflow editing and prevent untrusted editors from configuring the OpenAI Chat Model node or its options.baseURL setting. This reduces the ability to direct model-search requests and the associated credential to an arbitrary host.