N8N · GHSA-g333-hr44-g82p · AI agents & MCP
FIX → 3.2.2 · 2.48.3 +1
The AWS Bedrock Chat Model and Embeddings nodes in n8n let a custom Bedrock runtime endpoint bypass n8n's SSRF protection. A user who can create an AWS credential can make n8n send requests to internal or blocked addresses and see the start of the response in the node error.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-hosted n8n that use the AWS Bedrock Chat Model or Embeddings nodes, and that allow users to create AWS credentials. Exposure depends on a user with credential-creation rights who can set a custom Bedrock runtime endpoint. Instances that do not use these nodes or restrict credential creation to trusted users are less exposed.
Not affected if managed-hosting, no-bedrock-nodes
Who cares aws-bedrock, n8n, self-hosted, ssrf
n8n --version or the package in package.json; versions below 2.47.6, 2.48.3 or 3.2.2 on their respective lines are affected.The AWS Bedrock Chat Model and Embeddings AWS Bedrock nodes let an AWS credential set a custom Bedrock runtime endpoint. Requests to that endpoint did not go through n8n's SSRF protection. A member who could create an AWS credential could point the endpoint at an internal or otherwise blocked address and make n8n send requests to it, and could see the start of the response in the node error.
The issue has been fixed in n8n versions 2.47.6, 2.48.3 and 3.2.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 3.2.2 · 2.48.3 +1
2.47.6 (2.47 line)2.48.3 (2.48 line)3.2.2 (3.x line)