{"id":"CVE-2026-86074","title":"n8n is an open source workflow automation platform","summary":"n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-co…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","cwe":["CWE-918"],"vendor":"n8n","product":"n8n","affected":["n8n < 2.37.7","n8n >= 2.38.0, < 2.38.2"],"patched":["n8n 2.38.2"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T18:20:24.770","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86074","references":[{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-q5wm-mgqx-fv2f","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86074"},{"url":"https://github.com/advisories/GHSA-q5wm-mgqx-fv2f"}],"tags":["nvd","cve.org","ghsa","npm"],"epss":0.00277,"epssPercentile":0.2038,"aliases":["GHSA-q5wm-mgqx-fv2f"],"ecosystem":"npm","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T15:49:59.739685Z"},"scores":{"nvd":7.1,"cna":5.9},"ingestedAt":"2026-09-08T19:08:49.634Z","slug":"CVE-2026-86074","body":"## Overview\n\nn8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a user injected it into the setup flow, causing authenticated requests, redirects, or probes to reach another origin. The affected logic includes packages/@n8n/instance-ai/src/tools/workflows/credential-utils.ts and the extractServiceOrigin origin derivation. This issue is fixed in versions 2.37.7 and 2.38.2.\n\n## Affected\n\n- `n8n < 2.37.7`\n- `n8n >= 2.38.0, < 2.38.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `n8n 2.38.2`\n\n## Package advisory (CVE-2026-86074)\n\nAffected packages:\n\n- `n8n >= 2.38.0, < 2.38.2`\n- `n8n < 2.37.7`\n\nPatched in:\n\n- `n8n 2.38.2`\n- `n8n 2.37.7`\n\nSource: https://github.com/advisories/GHSA-q5wm-mgqx-fv2f","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202064,"id":"CVE-2026-86074","ts":1789400047455,"field":"cvss","old":"5.9","new":"7.1"},{"seq":202063,"id":"CVE-2026-86074","ts":1789400047455,"field":"severity","old":"medium","new":"high"},{"seq":200791,"id":"CVE-2026-86074","ts":1789397615745,"field":"cvss","old":"7.1","new":"5.9"},{"seq":200790,"id":"CVE-2026-86074","ts":1789397615745,"field":"severity","old":"high","new":"medium"},{"seq":199484,"id":"CVE-2026-86074","ts":1789395520180,"field":"cvss","old":"5.9","new":"7.1"},{"seq":199483,"id":"CVE-2026-86074","ts":1789395520180,"field":"severity","old":"medium","new":"high"},{"seq":198729,"id":"CVE-2026-86074","ts":1789392243346,"field":"cvss","old":"7.1","new":"5.9"},{"seq":198728,"id":"CVE-2026-86074","ts":1789392243346,"field":"severity","old":"high","new":"medium"},{"seq":197062,"id":"CVE-2026-86074","ts":1789384291758,"field":"cvss","old":"5.9","new":"7.1"},{"seq":197061,"id":"CVE-2026-86074","ts":1789384291758,"field":"severity","old":"medium","new":"high"},{"seq":194191,"id":"CVE-2026-86074","ts":1789378782411,"field":"cvss","old":"7.1","new":"5.9"},{"seq":194190,"id":"CVE-2026-86074","ts":1789378782411,"field":"severity","old":"high","new":"medium"},{"seq":192978,"id":"CVE-2026-86074","ts":1789376514396,"field":"cvss","old":"5.9","new":"7.1"},{"seq":192977,"id":"CVE-2026-86074","ts":1789376514396,"field":"severity","old":"medium","new":"high"},{"seq":191765,"id":"CVE-2026-86074","ts":1789373630425,"field":"cvss","old":"7.1","new":"5.9"},{"seq":191764,"id":"CVE-2026-86074","ts":1789373630425,"field":"severity","old":"high","new":"medium"},{"seq":190550,"id":"CVE-2026-86074","ts":1789369474644,"field":"cvss","old":"5.9","new":"7.1"},{"seq":190549,"id":"CVE-2026-86074","ts":1789369474644,"field":"severity","old":"medium","new":"high"},{"seq":189337,"id":"CVE-2026-86074","ts":1789368408333,"field":"cvss","old":"7.1","new":"5.9"},{"seq":189336,"id":"CVE-2026-86074","ts":1789368408333,"field":"severity","old":"high","new":"medium"},{"seq":188120,"id":"CVE-2026-86074","ts":1789365230054,"field":"cvss","old":"5.9","new":"7.1"},{"seq":188119,"id":"CVE-2026-86074","ts":1789365230054,"field":"severity","old":"medium","new":"high"},{"seq":186907,"id":"CVE-2026-86074","ts":1789363470618,"field":"cvss","old":"7.1","new":"5.9"},{"seq":186906,"id":"CVE-2026-86074","ts":1789363470618,"field":"severity","old":"high","new":"medium"},{"seq":185693,"id":"CVE-2026-86074","ts":1789361228391,"field":"cvss","old":"5.9","new":"7.1"},{"seq":185692,"id":"CVE-2026-86074","ts":1789361228391,"field":"severity","old":"medium","new":"high"},{"seq":184480,"id":"CVE-2026-86074","ts":1789358363000,"field":"cvss","old":"7.1","new":"5.9"},{"seq":184479,"id":"CVE-2026-86074","ts":1789358363000,"field":"severity","old":"high","new":"medium"},{"seq":182731,"id":"CVE-2026-86074","ts":1789354316421,"field":"cvss","old":"5.9","new":"7.1"},{"seq":182730,"id":"CVE-2026-86074","ts":1789354316421,"field":"severity","old":"medium","new":"high"},{"seq":181524,"id":"CVE-2026-86074","ts":1789353317024,"field":"cvss","old":"7.1","new":"5.9"},{"seq":181523,"id":"CVE-2026-86074","ts":1789353317024,"field":"severity","old":"high","new":"medium"},{"seq":180317,"id":"CVE-2026-86074","ts":1789350284048,"field":"cvss","old":"5.9","new":"7.1"},{"seq":180316,"id":"CVE-2026-86074","ts":1789350284048,"field":"severity","old":"medium","new":"high"},{"seq":179110,"id":"CVE-2026-86074","ts":1789348292193,"field":"cvss","old":"7.1","new":"5.9"},{"seq":179109,"id":"CVE-2026-86074","ts":1789348292193,"field":"severity","old":"high","new":"medium"},{"seq":177903,"id":"CVE-2026-86074","ts":1789346369345,"field":"cvss","old":"5.9","new":"7.1"},{"seq":177902,"id":"CVE-2026-86074","ts":1789346369345,"field":"severity","old":"medium","new":"high"},{"seq":176696,"id":"CVE-2026-86074","ts":1789343183848,"field":"cvss","old":"7.1","new":"5.9"},{"seq":176695,"id":"CVE-2026-86074","ts":1789343183848,"field":"severity","old":"high","new":"medium"},{"seq":174813,"id":"CVE-2026-86074","ts":1789334874976,"field":"cvss","old":"5.9","new":"7.1"},{"seq":174812,"id":"CVE-2026-86074","ts":1789334874976,"field":"severity","old":"medium","new":"high"},{"seq":173608,"id":"CVE-2026-86074","ts":1789333686150,"field":"cvss","old":"7.1","new":"5.9"},{"seq":173607,"id":"CVE-2026-86074","ts":1789333686150,"field":"severity","old":"high","new":"medium"},{"seq":172422,"id":"CVE-2026-86074","ts":1789331092331,"field":"cvss","old":"5.9","new":"7.1"},{"seq":172421,"id":"CVE-2026-86074","ts":1789331092331,"field":"severity","old":"medium","new":"high"},{"seq":171236,"id":"CVE-2026-86074","ts":1789328780214,"field":"cvss","old":"7.1","new":"5.9"},{"seq":171235,"id":"CVE-2026-86074","ts":1789328780214,"field":"severity","old":"high","new":"medium"},{"seq":170031,"id":"CVE-2026-86074","ts":1789327196480,"field":"cvss","old":"5.9","new":"7.1"},{"seq":170030,"id":"CVE-2026-86074","ts":1789327196480,"field":"severity","old":"medium","new":"high"}]}