CVE-2026-86074: n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

When a user sets up a credential through Instance AI, n8n verifies it with a test (probe) request. Before the fix, the URL for that probe was taken as given. n8n did not compare it with the origin of the workflow node the credential belongs to. A probe that carries authentication to an attacker's host hands over the secret.

The advisory is explicit about the limit: exfiltration required the user to actively inject an attacker-controlled URL into the setup flow. The title says the URL comes from fetched content, but the advisory does not describe the delivery path. That is why the CVSS vector sets user interaction to active and attack requirements to present.

The weakness is server-side request forgery (CWE-918). The realistic result is theft of third-party API credentials, such as tokens for services your workflows call. The rating reflects high confidentiality impact on the credential, with only low impact on other systems.

The patch derives the credential destination from the node's own URL. It confines authenticated requests, redirects and probes to that origin.

Affected: n8n from 2.38.0 up to but not including 2.38.2, and every release below 2.37.7. Only instances with the Instance AI module enabled go through the vulnerable setup flow. Check the version:

npm ls n8n

For Docker installs, read the version in the n8n UI under Settings, or from the image tag. Check whether N8N_ENABLED_MODULES includes instance-ai.

Upgrade to 2.38.2 or 2.37.7, or later:

npm install -g [email protected]

If you cannot upgrade yet, the advisory gives three stopgaps that it says do not fully remediate the risk:

• Remove instance-ai from the N8N_ENABLED_MODULES environment variable if you do not need it.
• Limit access to the n8n instance to fully trusted users.
• Rotate any third-party API credentials that were set up through the Instance AI credential-setup flow on affected versions.

Review outbound requests from the n8n host around the times users ran Instance AI credential setup. Look for probe or verification requests to hosts that do not match the service the credential belongs to. Ask users whether they pasted a URL taken from fetched or untrusted content into the setup flow. Check the provider logs of third-party APIs for credential use from unfamiliar IP addresses. If you find any such request, rotate that credential. The advisory lists no other indicators.

Impact

Instance AI credential setup accepted a credential test/verification URL without checking it matched the workflow node's origin. Exfiltration required the user to actively inject an attacker-controlled URL into the setup flow. The patch derives the credential destination from the node's own URL and confines authenticated requests, redirects and probes to that origin.

Patches

The issue has been fixed in n8n versions 2.38.2 and 2.37.7. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Disable the Instance AI module by removing instance-ai from the N8N_ENABLED_MODULES environment variable if it is not required.
• Restrict n8n instance access to fully trusted users only.
• Rotate any third-party API credentials that were set up using the Instance AI credential-setup flow on affected versions.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.