CyberRota Analysis
AI-GeneratedVersions of n8n prior to 2.34.1 are vulnerable to a server-side request forgery (SSRF) flaw that allows attackers to bypass URI validation by providing a safe URI with a malicious URL, potentially exposing internal network addresses. This vulnerability poses a medium risk, as it can lead to unauthorized access to sensitive internal resources. Organizations using n8n should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.
Related CVEs
Other vulnerabilities affecting the same vendor(s)