CVE-2026-86082

CVE-2026-86082 is a server-side request forgery (CWE-918) in the OpenAI Chat Model node of n8n, an open-source workflow automation platform, where allowed-domain restrictions on the OpenAI credential were enforced for normal model calls but not for the model-search dropdown. A workflow editor can set the node's options.baseURL to an arbitrary host; when the node loads its model list (the searchModels path in loadModels.ts), n8n sends the stored openAiApi credential to that host because the assertOpenAiCredentialAllowsUrl check was omitted. This can be triggered by opening or importing an untrusted workflow containing the node, letting an attacker capture the instance's OpenAI API key (high confidentiality impact, no integrity or availability impact, CVSS 4.0 score 7.1). Any self-hosted n8n instance running versions prior to 1.123.76, 2.37.7, or 2.38.2 is affected, particularly multi-user instances or instances where users import community workflow templates. There is no public proof-of-concept, no CISA KEV listing, and an EPSS of 0.2%, indicating no known exploitation at this time.

What to do: Upgrade self-hosted n8n to 1.123.76 on the 1.x branch or 2.37.7 / 2.38.2 on the 2.x branches, which add the missing allowed-domain check. Until patched, restrict workflow editing to trusted users and inspect imported workflows for OpenAI Chat Model nodes with custom baseURL values; if untrusted workflows were opened, rotate the affected openAiApi credentials and review outbound requests for unexpected destinations.