GHSA-34ff-336r-5q23: SSRF
Impact
The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain restriction an administrator configured did not hold for every route the node offered. The patch routes every OpenAI call site, including model listing, through one shared allowed-domains check.
Patches
The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Audit all domain-restricted openAiApi credentials and revoke use-only shares granted to untrusted users. - Rotate any openAiApi credential secrets that may have been exposed and review downstream OpenAI account activity for unexpected usage.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.123.76 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.37.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.38.2 - Compensating control
Restrict access to the n8n instance to fully trusted users only (temporary mitigation if upgrading is not immediately possible).
- Operational
Audit all domain-restricted `openAiApi` credentials and revoke any use-only shares granted to untrusted users.
- Operational
Rotate any `openAiApi` credential secrets that may have been exposed and review the downstream OpenAI account activity for unexpected usage (temporary mitigation if upgrading is not immediately possible).
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Instances where untrusted users can use the OpenAI Chat Model node and have access to domain-restricted openAiApi credentials are exposed. The risk is highest where those users have use-only shares to such credentials.
What does an attacker need to exploit it?
An attacker needs access to the model-search dropdown path and the ability to set options.baseURL. That path could send a request to an arbitrary host while attaching the configured credential.
What should administrators do if they cannot upgrade immediately?
Restrict the n8n instance to fully trusted users, audit domain-restricted openAiApi credentials, and revoke use-only shares granted to untrusted users. Rotate potentially exposed credential secrets and review downstream OpenAI account activity for unexpected usage; these are temporary mitigations only.
Which versions contain the fix?
Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2, or any later version. The fix applies the allowed-domains check through a shared path for all OpenAI call sites, including model listing.