n8n OpenAI Chat Model node: model-search path ignores credential domain limits and leaks the API key

Impact

n8n lets an administrator restrict which hosts a credential may be sent to, and the OpenAI Chat Model node enforced that on normal calls but not on the model-search dropdown: loadModels.ts omitted the assertOpenAiCredentialAllowsUrl check. A workflow editor can point options.baseURL at a host they control and have n8n send the stored openAiApi credential there. On a self-hosted n8n that fronts internal inference endpoints, this both exfiltrates the API key and turns the n8n instance into a request source aimed at an arbitrary host, which is why the vector carries a low scope-changed confidentiality bit. The practical damage is a leaked LLM credential, and where that credential is shared across a tenant's inference budget, unbudgeted spend and access to prompt traffic. Fixed in 1.123.76, 2.37.7 and 2.38.2.

Who can reach it

An authenticated n8n user with workflow editing rights on an instance that holds an openAiApi credential. No admin role and no network position are needed; the request originates from the n8n server itself, so it also reaches hosts that only n8n can talk to.

What to do

Upgrade n8n to 1.123.76, 2.37.7 or 2.38.2 depending on your branch and restart the n8n service or roll its deployment; no node or fleet work is involved. Because the flaw discloses a credential rather than corrupting state, rotate every openAiApi key held by an affected instance and review outbound request logs for unexpected baseURL hosts before assuming nothing was taken.

References

Related entries

• Hugging Face Transformers: path traversal in save_pretrained() writes files outside the save directoryCVE-2026-9856 · Hugging Face Transformers - save_pretrained() in PreTrainedTokenizerBase and ProcessorMixinHigh
• MLflow (`spark_udf` dir perms): Excessive directory permissionsCVE-2024-27134 · MLflow (`spark_udf` dir perms)High
• NVIDIA NemoClaw: code injection in the migration command gives a local user execution as the tool's privilegesCVE-2026-65082 · NVIDIA NemoClaw for Linux (migration command)High
• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
• BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium