n8n OpenAI Chat Model node: model-search path ignores credential domain limits and leaks the API key

Impact

n8n lets an administrator restrict which hosts a credential may be sent to, and the OpenAI Chat Model node enforced that on normal calls but not on the model-search dropdown: loadModels.ts omitted the assertOpenAiCredentialAllowsUrl check. A workflow editor can point options.baseURL at a host they control and have n8n send the stored openAiApi credential there. On a self-hosted n8n that fronts internal inference endpoints, this both exfiltrates the API key and turns the n8n instance into a request source aimed at an arbitrary host, which is why the vector carries a low scope-changed confidentiality bit. The practical damage is a leaked LLM credential, and where that credential is shared across a tenant's inference budget, unbudgeted spend and access to prompt traffic. Fixed in 1.123.76, 2.37.7 and 2.38.2.

Who can reach it

An authenticated n8n user with workflow editing rights on an instance that holds an openAiApi credential. No admin role and no network position are needed; the request originates from the n8n server itself, so it also reaches hosts that only n8n can talk to.

What to do

Upgrade n8n to 1.123.76, 2.37.7 or 2.38.2 depending on your branch and restart the n8n service or roll its deployment; no node or fleet work is involved. Because the flaw discloses a credential rather than corrupting state, rotate every openAiApi key held by an affected instance and review outbound request logs for unexpected baseURL hosts before assuming nothing was taken.

References

Related entries

• vLLM: forged FLAC sample rate bypasses duration limit and crashes the API serverCVE-2026-90555 · vLLM (OpenAI-compatible transcription endpoint, audio header validation)High
• Hugging Face Transformers: path traversal in save_pretrained() writes files outside the save directoryCVE-2026-9856 · Hugging Face Transformers - save_pretrained() in PreTrainedTokenizerBase and ProcessorMixinHigh
• MLflow (`spark_udf` dir perms): Excessive directory permissionsCVE-2024-27134 · MLflow (`spark_udf` dir perms)High
• NVIDIA NemoClaw: code injection in the migration command gives a local user execution as the tool's privilegesCVE-2026-65082 · NVIDIA NemoClaw for Linux (migration command)High
• llama.cpp: crafted GGUF tensor offsets read memory outside the mapped model fileCVE-2024-58399 · llama.cpp llama_model_loader (GGUF tensor offsets)Medium
• vLLM: unbounded cache_salt stalls the EngineCore scheduler thread, denying service to all requestsCVE-2026-100647 · vLLM (OpenAI- and Anthropic-compatible API server, cache_salt handling)Medium