CVE-2026-77069 n8n-io CVE debrief

Who should care

Defenders of n8n servers, administrators with credential creation permissions, and security teams monitoring for OAuth2 misconfigurations should be aware of this vulnerability. They should review their n8n server setups, verify OAuth2 configurations, and ensure proper SSRF protection in credential creation permissions to prevent potential exploitation. Additionally, security teams should assess their monitoring and detection capabilities to identify potential exploitation attempts. Asset inventory and vulnerability management teams should also be informed to prioritize remediation efforts. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. They should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Finally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review. This includes confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected n

Technical summary

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. A user with credential-creation permissions can set the access-token URL to an internal address, causing n8n to send a fixed-shape token-exchange POST to that target and reflect its response body back to the attacker. This issue allows attackers to potentially access internal systems or services that are not intended to be exposed.

Defensive priority

Defenders should prioritize verifying OAuth2 configurations, reviewing n8n server setups, and ensuring proper SSRF protection in credential creation permissions.

Recommended defensive actions

• Verify OAuth2 configurations for internal address exposure
• Review n8n server setups for credential creation permission misuse
• Ensure proper SSRF protection in n8n configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence is limited; primary official records indicate an SSRF protection bypass in n8n's OAuth2 credential authorization-code-to-access-token exchange. Verification tasks are needed for affected scope, inventory checks, and vendor remediation. Defenders should verify OAuth2 configurations, review n8n server setups, and ensure proper SSRF protection in credential creation permissions. Additional verification is required to confirm affected product deployments and assess potential impact.

Official resources