n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a user injected it into the setup flow, causing authenticated requests, redirects, or probes to reach another origin. The affected logic includes packages/@n8n/instance-ai/src/tools/workflows/credential-utils.ts and the extractServiceOrigin origin derivation. This issue is fixed in versions 2.37.7 and 2.38.2.
CVSS v3.1 Score
7.1
/ 10.0
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Information
- Published
- 8 sept. 2026
- Updated
- 11 sept. 2026
- Status
- Analyzed
- Source
- security-advisories@github.com
Affected products
n8n n8n
Versions : 2.37.7, 2.38.2
Weaknesses (CWE)
CWE-918
References (3)
- https://github.com/n8n-io/n8n/security/advisories/GHSA-q5wm-mgqx-fv2fMitigationVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-918
Loading…
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.