CVE-2026-86082: n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node en
Summary
n8n, an open source workflow automation platform, had a security flaw in its OpenAI Chat Model node where credential restrictions (rules about which websites are allowed) were not checked when searching for models in the editor dropdown. This allowed a workflow editor to redirect the API credential to an attacker's server by changing the base URL (the main web address where requests are sent). The vulnerability existed because the code that checks allowed domains was missing from the model-search feature.
Solution / Mitigation
This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Vulnerability Details
EPSS: 0.0%
September 8, 2026
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86082
First tracked: September 8, 2026 at 08:08 PM
Classified by LLM (prompt v3) · confidence: 92%