CVE-2026-85172 n8n-io CVE debrief

Who should care

Defenders responsible for n8n deployments should assess exposure and prioritize verification and remediation efforts. This includes verifying n8n versions, monitoring for suspicious activity, and implementing compensating controls for internal address access. Security teams should review relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

Defenders should care about CVE-2026-85172 because it allows attackers to bypass validation and access internal addresses in n8n versions before 2.34.1, potentially leading to unauthorized internal network access and data breaches.

• Verify and update n8n versions to prevent SSRF
• Monitor for suspicious internal address access attempts
• Implement compensating controls for internal address access
• Assess and mitigate potential business impact of SSRF exploitation

Technical summary

The vulnerability exists in the legacy request helper function exposed to Code and Function nodes in n8n versions before 2.34.1. The validation logic checks the 'uri' property for SSRF safety, while the underlying HTTP client uses the 'url' property when both are present, allowing attackers to bypass validation by supplying a safe 'uri' alongside a malicious 'url' to access internal addresses. The flaw is caused by inconsistent validation logic and can be mitigated by updating to version 2.34.1 or later. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using n8n versions before 2.34.1.

Recommended defensive actions

• Verify n8n version and assess exposure
• Update to version 2.34.1 or later
• Monitor for suspicious activity
• Implement compensating controls for internal address access
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The validation logic checks the 'uri' property for SSRF safety, while the underlying HTTP client uses the 'url' property when both are present.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.