CVE-2026-77069

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no SSRF guard. A user with credential-creation permissions can set the access-token URL to an internal address and complete the OAuth2 flow, causing n8n to send a fixed-shape token-exchange POST to that target and reflect its response body back to the attacker (limited to what the target returns to this specific request).

• CWE-918

• https://github.com/n8n-io/n8n/security/advisories/GHSA-c4f6-59xq-95wwMitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/n8n-before-ssrf-protection-bypass-via-oauth2Third Party Advisory

Published

Aug 20, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77061boneIO Black directly excludes several API endpoints from th…5.3
• CVE-2026-77062The boneIO Black web interface lacks proper clickjacking pro…6.9
• CVE-2026-77063multer is a middleware for handling multipart/form-data in N…3.7
• CVE-2026-77066The scanFeedsResolver in packages/api/src/resolvers/subscrip…5
• CVE-2026-77067The setWebhookResolver in packages/api/src/resolvers/webhook…5
• CVE-2026-77068n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote …8.8
• CVE-2026-7707A vulnerability was found in Open5GS up to 2.7.7. Impacted i…4.3
• CVE-2026-77070n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL inj…9.8
• CVE-2026-77071n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST…9.8
• CVE-2026-77072n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cr…7.6
• CVE-2026-77073n8n versions before 2.34.1 contain a credential validation b…4.3
• CVE-2026-77074n8n versions before 1.123.69 contain a server-side request f…6.5