CVE-2026-65593: n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required.

By supplying an absolute URL in the routing configuration, a caller could override the node type’s declared baseURL, defeating the restriction meant to confine requests to the node’s own upstream service. With SSRF protection disabled by default (N8N_SSRF_PROTECTION_ENABLED=false), this let an authenticated user make the n8n server issue HTTP requests to arbitrary internal targets.