n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

The version of the n8n Node.js Package installed on the remote host is less than 1.123.76, or is 2.0.x prior to 2.37.7, or is 2.38.x prior to 2.38.2. It is, therefore, affected by multiple vulnerabilities:

  - n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and     2.38.2, the legacy expression engine generated source text by calling the mutable     global JSON.stringify while printing synthetic string literals and interpolating     timezone data. An expression could replace JSON.stringify and cause later generated     source to contain executable attacker-controlled code. The affected code-generation     paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and     packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the     vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
    (CVE-2026-86083)

  - n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and     2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions     for normal calls but not for the model-search dropdown. A workflow editor could set     options.baseURL to an arbitrary host and make the searchModels path send the     openAiApi credential there. The affected implementation is     packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which     omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76,     2.37.7 and 2.38.2. (CVE-2026-86082)

  - n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and     2.38.2, the Git node clone operation matched an attacker-controlled destination path     against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern allowed     catastrophic backtracking and ran synchronously in the main n8n process. An     authenticated workflow editor could therefore freeze the instance with one workflow     execution; the affected default is declared in     packages/@n8n/config/src/configs/security.config.ts. This issue is fixed in versions     1.123.76, 2.37.7 and 2.38.2. (CVE-2026-86081)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat
    Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search
    dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path
    send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-
    langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl.
    This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. (CVE-2026-86082)

ID	Name	Product	Family	Type	Severity
347980	n8n Node.js Package < 1.123.76 / 2.0.x < 2.37.7 / 2.38.x < 2.38.2 Multiple Vulnerabilities	Nessus	Misc.	Local	high
447889	SCA: security update for n8n (GHSA-34ff-336r-5q23)	Tenable Cloud Security	SCA Checks	Local	high
447889	SCA: security update for n8n (GHSA-34ff-336r-5q23)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-86082

high

Tenable Plugins

high

high

high