The vulnerable component allows an authenticated user to create SearXNG credentials and configure a personal agent. During this process, the tool uses a raw HTTP client that bypasses n8n’s centralized SSRF protection, enabling the server to send requests to any user‑supplied API URL. The attacker can set the URL to an internal host, causing the n8n server to reach that host and relay the response content back through the Agent chat output. This flaw provides a pathway for internal network reconnaissance, data exfiltration, and potentially further internal attacks, classified as a Remote Server Side Request Forgery (CWE‑918).

n8n‑io’s n8n platform is impacted. All installations running versions prior to 2.34.1 and releases of the 2.33.x branch before 2.33.4 are affected. Any deployment that has SSRF protection enabled and allows users to create SearXNG credentials can suffer this vulnerability.

With an overall CVSS score of 6.3, the vulnerability is considered medium severity. The EPSS score is not available, so the likelihood of public exploitation remains uncertain, yet the flaw’s exploitation requires only local authentication with permission to create SearXNG credentials, a role that many users possess. Because the attack bypasses central SSRF controls, any internal host address can be targeted, leading to information exposure or further internal compromise. The feature is not exposed externally; thus the attack vector is an authenticated user rather than a remote unauthenticated attacker.