https://seclists.org/oss-sec/2026/q2/1046: n8n: SSRF mains exploitable in default configuration (incomplete fix, no CVE)
Published Jun 27, 2026
·Updated
Affected Software
1 affected component
n8n<=2.19.x, >undefined
Frequently Asked Questions
1
What is the severity of n8n SSRF vulnerability?
The n8n SSRF vulnerability is considered critical due to its potential to expose sensitive data and allow unauthorized actions.
2
How do I fix n8n SSRF vulnerability?
To fix the n8n SSRF vulnerability, ensure that N8N_SSRF_PROTECTION_ENABLED is set to true in your configuration.
3
Which versions of n8n are affected by the SSRF vulnerability?
N8N versions 2.19.x and 2.20.0+ when N8N_SSRF_PROTECTION_ENABLED is unset are affected by the SSRF vulnerability.
4
Is there a CVE for the n8n SSRF vulnerability?
No, there is currently no CVE associated with the n8n SSRF vulnerability.
5
What components are exploited in the n8n SSRF vulnerability?
The n8n SSRF vulnerability is exploited through the /rest/workflows/from-url endpoint.