n8n Instance AI Credential Setup SSRF/Exfiltration via Unvalidated Probe URL
First seen Sep 13, 2026 · Updated Sep 13, 2026
A vulnerability in n8n's Instance AI credential setup flow allowed a credential test/verification request to be sent to an arbitrary URL instead of being restricted to the workflow node's own origin. If an attacker could get a malicious URL injected into the setup flow, authenticated credential-test requests (potentially including secrets) could be redirected to an attacker-controlled endpoint. Exploitation requires user interaction to inject the malicious URL, which lowers real-world risk but still represents a credential exfiltration and SSRF-adjacent flaw.
Technical Analysis
The Instance AI module in n8n lets users configure and test AI-related credentials against a node-defined endpoint. The flawed implementation trusted a probe/verification URL sourced from fetched content or setup input without validating that it matched the origin of the workflow node initiating the request. An attacker who can influence this URL (e.g., via a poisoned workflow, shared template, or malicious link in the setup flow) can redirect the authenticated credential-test request to an attacker-controlled server, capturing API keys, tokens, or other sensitive credential material in transit. This crosses the boundary between the n8n orchestration layer and external AI/third-party services, turning a legitimate credential-verification tool call into a data-exfiltration primitive. The fix constrains the credential destination, redirects, and probe requests to the originating node's own origin, closing the SSRF-like trust gap.
Affected Systems
n8n
Detection Signatures
- Outbound credential-verification requests to domains not matching the configured node/workflow origin
- Unexpected HTTP redirects during Instance AI credential setup/test calls
- Credential-test traffic to newly registered or non-allowlisted external domains
- Workflow definitions containing externally fetched or user-supplied URLs used directly as verification endpoints
- Log entries showing N8N_ENABLED_MODULES with instance-ai active alongside anomalous outbound connections during credential setup
Remediation Steps
- 1
Upgrade n8n
Update to n8n 2.38.2, 2.37.7, or later, which restricts credential-destination, redirect, and probe requests to the workflow node's own origin.
- 2
Disable Instance AI if unused
Remove 'instance-ai' from N8N_ENABLED_MODULES if the feature is not required, eliminating the vulnerable code path.
- 3
Restrict instance access
Limit n8n instance access to fully trusted users to reduce the chance of malicious URL injection into the setup flow.
- 4
Rotate credentials
Rotate any third-party API keys or credentials configured through the Instance AI credential-setup flow on affected versions, as they may have been exposed.
- 5
Monitor outbound requests
Add egress monitoring/allowlisting for credential-verification traffic to detect requests to unexpected destinations.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.