SSRF Protection Bypass in n8n OAuth2 Credential Exchange

CVE-2026-77069

What is CVE-2026-77069?

n8n contains a vulnerability that allows a Server-Side Request Forgery (SSRF) protection bypass during the OAuth2 authorization-code-to-access-token exchange. This occurs because while OAuth2 discovery requests are properly handled by n8n's SSRF-protected HTTP client, the token exchange is performed using a separate client that lacks SSRF protections. An attacker with permissions to create credentials can exploit this by setting the access-token URL to an internal address, thus making n8n send a token-exchange POST request to an internal server, potentially exposing sensitive data returned by that internal target.

References