CVE-2026-86082: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
Impact
The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain restriction an administrator configured did not hold for every route the node offered. The patch routes every OpenAI call site, including model listing, through one shared allowed-domains check.
Patches
The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Audit all domain-restricted openAiApi credentials and revoke use-only shares granted to untrusted users. - Rotate any openAiApi credential secrets that may have been exposed and review downstream OpenAI account activity for unexpected usage.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Configuration
Restrict the n8n instance access to fully trusted users only as a temporary mitigation if upgrading is not immediately possible.
n8n Access control for n8n instance = fully trusted users only - Operational
Audit all domain-restricted `openAiApi` credentials and revoke use-only shares granted to untrusted users.
- Operational
Rotate any `openAiApi` credential secrets that may have been exposed and review downstream OpenAI account activity for unexpected usage.
Event History
Frequently Asked Questions
Who can exploit this issue?
A workflow editor who can configure an OpenAI Chat Model node and use an OpenAI API credential can set options.baseURL to an arbitrary host. The vulnerable model-search dropdown path can then send that credential to the selected host.
Are normal OpenAI Chat Model requests affected?
The allowed-domain restriction was enforced for normal calls. The bypass was limited to the model-search dropdown path, implemented by searchModels in loadModels.ts.
Which versions contain the fix?
The issue is fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Versions prior to those releases are affected.
What can be done if upgrading is not immediately possible?
Restrict workflow editing and prevent untrusted editors from configuring the OpenAI Chat Model node or its options.baseURL setting. This reduces the ability to direct model-search requests and the associated credential to an arbitrary host.