What happened
CVE-2026-86082 (CVSS 7.1, high) affects n8n, an open-source workflow automation platform widely used for building AI-integrated automations. Prior to versions 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown; a workflow editor could set options.baseURL to an arbitrary host and cause the model-search feature to send the configured OpenAI credential to an attacker-controlled endpoint.
Why it matters
n8n is heavily used to orchestrate LLM-powered automations and AI agents; this flaw lets any workflow editor exfiltrate the OpenAI API credential/key configured for a Chat Model node to an arbitrary attacker-controlled server, bypassing the allowed-domain control that was specifically meant to prevent exactly this kind of credential leakage in AI-connected workflows.
Attack vector
A workflow editor sets options.baseURL on the OpenAI Chat Model node's model-search dropdown to an attacker-controlled host, which is not subject to the credential's allowed-domain restriction, causing the credential to be sent to that host.
Affected systems
n8n prior to 1.123.76, 2.37.7, and 2.38.2
Mitigation
Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2 or later.