---
id: GHSA-38fj-36m5-783c
title: >-
  Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints
  Allows Internal Network Access
summary: >-
  Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints
  Allows Internal Network Access
severity: medium
cwe:
  - CWE-918
vendor: n8n
product: n8n
ecosystem: npm
affected:
  - n8n < 1.123.64
published: '2026-07-22'
updated: '2026-07-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-38fj-36m5-783c'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-9w78-79q7-r4fp'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65593'
  - url: >-
      https://www.vulncheck.com/advisories/n8n-before-ssrf-via-dynamic-node-parameters
  - url: 'https://github.com/advisories/GHSA-38fj-36m5-783c'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-22T22:06:58.115Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references.

## Original Description

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

## Affected packages

- `n8n < 1.123.64`

## Remediation

Refer to the advisory for the patched release.