CVE-2026-86082

What it actually does

In affected n8n versions, the OpenAI Chat Model node applies credential allowed-domain checks on normal model calls but not on the model-search/loadModels path. An authenticated workflow editor can set the node’s options.baseURL to an arbitrary URL so that searchModels issues a server-side HTTP request that includes the stored openAiApi credential. This is SSRF with credential disclosure: the n8n host fetches an attacker-chosen or internal URL while attaching a high-value API token. Confidentiality of the secret (and any data reachable through that request) is impacted; n8n integrity and availability are not directly affected.

Why it matters to the business

Stolen OpenAI-compatible API keys can cause unexpected AI usage bills, provider lockouts, and exposure of data those keys can access. Only workflow-editor rights are required, so a compromised or malicious low-privilege user is sufficient. n8n commonly sits in the middle of business automations, so a leaked key may also unlock other services that reuse the same secret. The issue is not in CISA KEV, is not tied to ransomware, and has no public exploit maturity about 28 days after publication; still treat internet-exposed or multi-tenant n8n as high urgency and tightly access-controlled self-hosted instances as moderate-high until patched and keys rotated.

How an attack unfolds

An attacker with (or who obtains) n8n workflow-edit permission attaches a stored openAiApi credential to an OpenAI Chat Model node, points the node’s base URL at a host they control or at an internal service, and triggers model search. Because loadModels omitted the allowed-URL assertion used elsewhere, n8n sends the credential on that outbound request. The attacker recovers the token from their listener or infers internal-network behavior from the response, then uses the key outside n8n for unauthorized API use. No named threat actors or in-the-wild campaigns are reported for this issue.

How to fix it

Upgrade n8n to 1.123.76 (1.x line), 2.37.7 (2.37 line), or 2.38.2 (2.38 line) or later; those releases add the missing allowed-URL assertion on model search. Until upgraded: limit who can create or edit workflows; enforce credential allowed-domains and treat any OpenAI Chat Model base-URL override as untrusted; restrict n8n egress to approved LLM API hosts; rotate every openAiApi credential that may have been used on untrusted workflows; and review stored workflows for unexpected baseURL values on OpenAI Chat Model nodes.

How to confirm the fix worked

Confirm the running n8n version is 1.123.76, 2.37.7, 2.38.2, or newer. After upgrade, verify that model listing for an OpenAI Chat Model node refuses base URLs outside the credential’s allowed domains and does not send the credential off-box. Inventory workflows and credentials for non-default baseURL values on OpenAI Chat Model / LMChatOpenAi nodes. Confirm egress or proxy logs no longer show the n8n process calling unexpected hosts during model listing.

Typical attack path

1. Obtain an n8n account that can edit workflows (editor, not necessarily admin).
2. Attach a stored openAiApi credential to an OpenAI Chat Model node.
3. Override the node base URL to an unapproved external or internal host, bypassing the domain restriction that applies only to normal chat calls.
4. Trigger model search so n8n performs a server-side request that includes the credential.
5. Capture the API token or observe the internal response, then abuse the stolen key for unauthorized model usage or further access.

How to detect it

This leaves traces in n8n workflow definitions and in outbound HTTP from the n8n process, not in a distinct malware family. Export or query saved workflows for OpenAI Chat Model / LMChatOpenAi nodes whose options.baseURL is not the organization’s approved OpenAI or Azure OpenAI endpoint. On the n8n host and any egress proxy, look around the time editors used the model-search dropdown for requests to unexpected destinations that resemble an OpenAI models-list call and carry an Authorization Bearer token. Review n8n audit or user-activity logs for workflow updates that changed that node’s base URL, especially from non-admin editors. Provider billing and key-usage dashboards may show sudden usage from unfamiliar IPs after a possible leak. No public exploit kit or named actor TTPs are associated with this CVE.

• Workflow JSON: OpenAI Chat Model / LMChatOpenAi node with options.baseURL not equal to the approved api.openai.com or Azure OpenAI endpoint
• Workflow parameter string: "baseURL" on langchain OpenAI chat model nodes (LMChatOpenAi)
• n8n node type references: LMChatOpenAi or @n8n/n8n-nodes-langchain.lmChatOpenAi combined with a custom baseURL
• Outbound HTTP from the n8n process to unapproved hosts requesting a models-list style path with an Authorization: Bearer header
• Egress/proxy logs: n8n user-agent or n8n worker source calling non-allowlisted hosts at the moment an editor loaded the model-search dropdown
• n8n audit/activity events: workflow update touching OpenAI Chat Model node options by a non-admin editor

What your security team should do

• Patch all n8n instances to 1.123.76, 2.37.7, or 2.38.2+ immediately, prioritizing internet-facing and multi-user editors.
• Rotate all openAiApi and compatible provider keys that were available to workflow editors before the patch, and revoke unused keys.
• Restrict workflow-edit and credential-use permissions to least privilege and review who can attach OpenAI credentials.
• Enforce egress allowlists so n8n can reach only approved LLM API endpoints.
• Hunt historical workflow definitions and outbound logs for OpenAI Chat Model nodes with non-default base URLs, then treat those credentials as compromised.