CVE-2026-77085

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-77085

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77085.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-77085

Aliases

GHSA-9rp2-wm75-c5fj

Published

2026-08-20T11:21:15.741Z

Modified

2026-08-23T03:42:26.849854996Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool

Details

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTION_ENABLED=true, an authenticated user with permission to create SearXNG credentials and configure a personal agent could set the API URL to an internal host, causing the n8n server to connect to that host and return the response content through the Agent chat output.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77085.json"
}

References

Affected packages

Git / github.com/n8n-io/n8n

Affected ranges

Type

GIT

Repo

https://github.com/n8n-io/n8n

Events

Introduced

b533ecd6856fef9ba7ca096d14b1f798b9933ff6

Fixed

e2279d07cdc8d1aeee42607a15365ccfa98f8b27

Introduced

a8ecda44f7627630bc8b78cf671405157ad41c4f

Fixed

14c9aef0552fb4776501ca1c4589451891dd0ef4

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "2.34.0"
        },
        {
            "fixed": "2.34.1"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.33.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

n8n@2.*

n8n@2.34.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77085.json"