n8n OpenAI Chat Model Node Domain-Restriction Bypass via Model-Search Endpoint

Technical Analysis

The vulnerability is an inconsistent authorization check: n8n's credential model allows admins to restrict a shared openAiApi credential to specific domains, but this check was only applied at some code paths and not at the model-search dropdown's request handler. An attacker who can edit or configure a workflow (e.g., a lower-privileged user granted 'use' access to a shared credential) can set `options.baseURL` to an attacker-controlled server on the unguarded path, causing n8n to send the OpenAI API key/secret to that server, effectively exfiltrating the credential and enabling SSRF-style abuse of the agent's tool infrastructure. This crosses a trust boundary because the credential is meant to be usable only against approved AI provider endpoints, but the flaw lets an untrusted workflow author redirect API traffic to an arbitrary host that could log or reuse the leaked key. The impact is credential theft and potential downstream abuse of the victim's OpenAI account/usage quota, not remote code execution.

Affected Systems

n8n

Detection Signatures

• Outbound HTTPS requests from n8n containing Authorization/Bearer OpenAI-style keys to non-OpenAI, non-allowlisted domains
• Workflow JSON or node configs setting options.baseURL to unexpected/external hosts on Chat Model or model-search nodes
• Unexpected OpenAI account usage/billing spikes not correlated with known legitimate n8n workflows
• Credential 'use-only' shares granted to low-trust users combined with base URL override fields populated
• n8n audit logs showing model-list/model-search API calls immediately followed by requests to non-standard hosts

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 1.123.76, 2.37.7, 2.38.2, or later, which route all OpenAI call sites (including model listing) through the shared allowed-domains check.

2. 2

   Restrict instance access

   Limit n8n instance and workflow-editing access to fully trusted users until patched, since the bypass requires the ability to configure node options.

3. 3

   Audit and revoke credential shares

   Review all domain-restricted openAiApi credentials and revoke 'use-only' access granted to untrusted or lower-privileged users.

4. 4

   Rotate exposed secrets

   Rotate any OpenAI API credentials that may have been used in workflows accessible to untrusted users prior to patching.

5. 5

   Review OpenAI account activity

   Audit downstream OpenAI account usage logs for unexpected API calls or hosts that could indicate credential exfiltration via this bypass.