The vulnerability allows authenticated users to supply absolute URLs in the dynamic-node-parameters routing configuration. Because the endpoints lack proper authorization scopes, the n8n server can issue HTTP requests to arbitrary internal targets when SSRF protection is disabled. This results in a Server‑Side Request Forgery flaw that can expose internal resources or allow attackers to perform actions against services inside the network, as defined by CWE‑918.

All installations of n8n before version 1.123.64, 2.29.8, and 2.30.1 are affected. The vulnerability resides in the n8n product from n8n‑io and impacts any deployment using these pre‑1.123.64 or earlier 2.x versions that have not been patched.

The CVSS score of 6.3 indicates moderate severity. Exploitation requires that the attacker be authenticated and has access to the vulnerable endpoint, which does not enforce appropriate scopes. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, attackers that can abuse the endpoint can reach internal resources, so monitoring for abnormal outbound traffic and enabling SSRF protections are advised.