CVE-2026-86074 is a high severity flaw in n8n's Instance AI credential setup. It accepted a credential test URL without checking that it matched the workflow node's origin, so authenticated requests could reach another origin. Upgrade to 2.37.7 or 2.38.2, or disable the Instance AI module.
What's affected
- Product: n8n, the Instance AI credential setup flow.
- Affected: versions before 2.37.7 and before 2.38.2.
- Fixed: 2.37.7 and 2.38.2 (both released 2 September 2026). GitHub marks 2.38.2 as a pre-release, so the stable choice is 2.37.7 or later on its line.
- Condition from the advisory: a user must actively inject an attacker controlled URL into the setup flow.
Severity in the record: High, CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). The record scores it 7.1 (High) under CVSS v3.1. The n8n GitHub advisory rates it Moderate, 5.9 under CVSS v4. Treat it as a priority if you use Instance AI credential setup.
Weakness class: CWE-918 (Server-Side Request Forgery).
How to check if you're exposed
- Find your version. For a global npm install,
n8n --versionprints it. For Docker, rundocker exec my-n8n n8n --version, or read the image tag. - Compare it with the fixed releases for your line, listed above.
- Check whether the Instance AI module is enabled. It is enabled through the
N8N_ENABLED_MODULESenvironment variable. - List credentials that were created through the Instance AI setup flow.
What to do now
- Upgrade to 2.37.7, 2.38.2 or later.
- If you cannot upgrade now and do not use it, remove
instance-aifromN8N_ENABLED_MODULES. - Rotate third party API credentials that were set up through the Instance AI flow on an affected version, as the advisory advises.
- Restrict the instance to trusted users.
- Tell users not to paste links from untrusted content into setup flows.
Why it matters
Credential setup sends a request to a service to check the key works. If the destination can be steered, the key goes where the attacker chooses. The advisory says content fetched from elsewhere could influence the URL after a user injected it. The patch derives the destination from the node's own URL and keeps authenticated requests, redirects and probes inside that origin. The class is server side request forgery, CWE-918.
The need for user action explains the lower vendor rating. Still, credential leakage is costly and hard to notice, which is why rotation is part of the advice. No exploitation in the wild is claimed in the record.
Quick check
Why do the sources disagree on severity?
They use different scoring versions and inputs. The record has 7.1 under CVSS v3.1, and the advisory 5.9 under CVSS v4, which counts the required user action differently.
Sources
Last reviewed: 18 October 2026.
