CVE-2026-85172 n8n-io CVE debrief

Who should care

Defenders responsible for n8n deployments, including DevOps and security teams, should assess exposure and prioritize patching or mitigation to prevent potential SSRF attacks. This includes verifying n8n inventory, reviewing compensating controls, and applying the vendor-provided patch or mitigation. Roles responsible for n8n deployments should also consider the potential operational impacts, such as unauthorized access to internal addresses and possible data breaches, and take steps to mitigate these risks. Additionally, defenders should review relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. The evidence is limited, and further verification is required to determine the full scope of the vulnerability and its consequences. Therefore, defenders should exercise caution and take a defensive approach to verifying their n8n inventory and assessing exposure. This may involve reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. By taking these steps, defenders can help prevent potential SSRF attacks and minimize the risk of unauthorized access or data breaches. The CVE description and source references indicate a validation logic flaw in the n8n legacy request helper function, but details on exploitation, impact, and remediation beyond version 2.34.1 are limited, emphasizing the need for defenders to prioritize verification and mitigation efforts. Furthermore, defenders should consider the potential for asset inventory and source tracking to help identify and mitigate potential vulnerabilities. By prioritizing verification, assessment, and mitigation, defenders can help protect their n8n deployments from potential SSRF attacks and minimize the risk of unauthorized access or data breaches. Therefore, it is essential for defenders to take a proactive and defensive approach to addressing this vulnerability, including verifying their n8n inventory, assessing exposure,

Why it matters

Defenders should care about CVE-2026-85172 because it allows attackers to bypass validation and access internal addresses in n8n versions before 2.34.1, potentially leading to unauthorized access or data breaches. Roles responsible for n8n deployments, such as DevOps and security teams, should assess exposure and prioritize patching or mitigation efforts. The evidence is limited, and further verification is required to determine the full scope of the vulnerability and its consequences.

• Potential unauthorized access to internal addresses
• Possible data breaches or system compromise
• Need for verification of n8n inventory and exposure
• Prioritization of patching or mitigation efforts

Technical summary

The n8n workflow automation tool contains a server-side request forgery vulnerability in versions before 2.34.1. The legacy request helper function exposed to Code and Function nodes has a validation logic flaw. This flaw occurs because the validation logic checks the 'uri' property for SSRF safety, while the underlying HTTP client uses the 'url' property when both are present. An attacker can bypass validation by supplying a safe 'uri' alongside a malicious 'url' to access internal addresses.

Defensive priority

Defenders should prioritize verifying their n8n inventory, assessing exposure, and applying the vendor-provided patch or mitigation to prevent potential SSRF attacks.

Recommended defensive actions

• Verify n8n workflow automation tool deployments for versions before 2.34.1.
• Assess exposure of internal addresses to potential SSRF attacks.
• Apply the vendor-provided patch or mitigation for n8n versions before 2.34.1.
• Review compensating controls for exposed systems while remediation is scheduled and verified for n8n deployments.
• Check relevant monitoring, detection, and logs for exposed n8n assets that need extra review.
• Track exceptions, retest remediated n8n assets, and close the item only after evidence is documented.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance for n8n.

Evidence notes

The CVE description and source references indicate a validation logic flaw in the n8n legacy request helper function. However, details on exploitation, impact, and remediation beyond version 2.34.1 are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.