This vulnerability is a server‑side request forgery flaw that allows an authenticated n8n user to bypass the Allowed HTTP Request Domains restriction on the POST /rest/dynamic-node-parameters/options endpoint. By sending crafted requests, the attacker can cause the n8n server to initiate HTTP calls to arbitrary hosts, delivering credentials stored on the server to those endpoints. The exposed data may include authentication tokens or other sensitive configuration values, compromising the integrity and confidentiality of the system.

n8n is affected in all releases prior to 2.20.0. Hosts running these earlier versions are vulnerable, while versions 2.20.0 and later contain the fix.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with sufficient privileges to access the dynamic-node-parameters endpoint, after which the attacker can direct the server to transmit credentials to unauthorized hosts. No additional prerequisites such as network reachability are stated, so the risk is limited to environments where such users exist.