{"id":"GHSA-g333-hr44-g82p","kind":"vulnerability","aliases":["GHSA-g333-hr44-g82p"],"related":[],"title":"AWS Bedrock Nodes Skip SSRF Protection for Custom Runtime Endpoints","description":"## Impact\n\nThe AWS Bedrock Chat Model and Embeddings AWS Bedrock nodes let an AWS credential set a custom Bedrock runtime endpoint. Requests to that endpoint did not go through n8n's SSRF protection. A member who could create an AWS credential could point the endpoint at an internal or otherwise blocked address and make n8n send requests to it, and could see the start of the response in the node error.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.47.6, 2.48.3 and 3.2.2. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Audit AWS credentials and remove any custom Bedrock Runtime Endpoint that is not expected.\n- Apply network-level controls to restrict outbound connections from the n8n host to internal addresses.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"The AWS Bedrock Chat Model and Embeddings nodes in n8n let a custom Bedrock runtime endpoint bypass n8n's SSRF protection. A user who can create an AWS credential can make n8n send requests to internal or blocked addresses and see the start of the response in the node error.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":["2.48.3"],"affected":"< 2.48.3","ecosystem":"npm"},{"name":"n8n","fixed":["2.47.6"],"affected":"< 2.47.6","ecosystem":"npm"},{"name":"n8n","fixed":["3.2.2"],"affected":"< 3.2.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","aws-bedrock","n8n","self-hosted","ssrf"],"not_affected_if":["managed-hosting","no-bedrock-nodes"],"how_to_check":"- Check the n8n version with `n8n --version` or the package in `package.json`; versions below `2.47.6`, `2.48.3` or `3.2.2` on their respective lines are affected.\n- Review AWS credentials in n8n for any custom Bedrock Runtime Endpoint that is not expected.","fix":"- n8n `2.47.6` (2.47 line)\n- n8n `2.48.3` (2.48 line)\n- n8n `3.2.2` (3.x line)","status":"open","published_at":"2026-11-13T10:55:56+00:00","first_seen_at":"2026-11-13T11:06:24+00:00","triaged_at":"2026-11-13T11:06:57+00:00","updated_at":"2026-11-13T11:06:57+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-13T11:06:57Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `2.47.6` (2.47 line)\n- n8n `2.48.3` (2.48 line)\n- n8n `3.2.2` (3.x line)","reach":"network","title":"n8n: AWS Bedrock nodes skip SSRF protection on custom endpoints","impact":"medium","summary":"The AWS Bedrock Chat Model and Embeddings nodes in n8n let a custom Bedrock runtime endpoint bypass n8n's SSRF protection. A user who can create an AWS credential can make n8n send requests to internal or blocked addresses and see the start of the response in the node error.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","aws-bedrock","ssrf"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Internal addresses reachable through n8n; partial response data leaks","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the package in `package.json`; versions below `2.47.6`, `2.48.3` or `3.2.2` on their respective lines are affected.\n- Review AWS credentials in n8n for any custom Bedrock Runtime Endpoint that is not expected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-bedrock-nodes","managed-hosting"],"who_is_affected":"Teams running self-hosted n8n that use the AWS Bedrock Chat Model or Embeddings nodes, and that allow users to create AWS credentials. Exposure depends on a user with credential-creation rights who can set a custom Bedrock runtime endpoint. Instances that do not use these nodes or restrict credential creation to trusted users are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000819,"input_tokens":4935,"output_tokens":650,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'2.47.6':165C '2.48.3':166C '3.2.2':168C 'access':200C 'address':73B,136C,235C 'administr':190C 'ai':25B 'ai-tool':24B 'appli':220C 'audit':206C 'aw':1A,28B,36B,62B,87C,93C,98C,124C,207C 'aws-bedrock':27B 'bedrock':2A,29B,37B,48B,88C,94C,103C,213C 'block':72B,135C 'bypass':51B 'chat':38B,89C 'connect':228C 'consid':192C 'control':224C 'could':121C,126C,145C 'creat':60B,122C 'credenti':63B,99C,125C,208C 'custom':8A,47B,102C,212C 'embed':41B,92C 'endpoint':10A,50B,105C,109C,129C,215C 'error':84B,155C 'expect':219C 'fix':161C 'follow':194C 'fulli':202C,240C 'g333':13A,18A 'g82p':15A,20A 'ghsa':12A,17A 'ghsa-g333-hr44-g82p':11A,16A 'go':112C 'host':33B,232C 'hr44':14A,19A 'immedi':188C 'impact':85C 'instanc':199C 'intern':70B,132C,234C 'issu':158C 'later':178C 'let':45B,96C 'level':223C 'make':65B,138C 'measur':254C 'member':119C 'mitig':196C,253C 'model':39B,90C 'n8n':21A,22A,23A,30B,44B,52B,66B,114C,139C,163C,198C,231C 'network':222C 'network-level':221C 'node':3A,42B,83B,95C,154C 'one':173C 'otherwis':134C 'outbound':227C 'patch':156C 'point':127C 'possibl':189C 'protect':6A,55B,117C 'remedi':180C,241C 'remov':210C 'request':68B,106C,141C 'respons':80B,151C 'restrict':197C,226C 'risk':243C 'runtim':9A,49B,104C,214C 'see':75B,146C 'self':32B 'self-host':31B 'send':67B,140C 'set':100C 'short':251C 'short-term':250C 'skip':4A 'ssrf':5A,34B,54B,116C 'start':77B,148C 'temporari':195C 'term':252C 'tool':26B 'trust':203C 'upgrad':171C,185C 'use':248C 'user':57B,169C,204C 'version':164C,176C 'vulner':182C 'workaround':183C,237C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted n8n that use the AWS Bedrock Chat Model or Embeddings nodes, and that allow users to create AWS credentials. Exposure depends on a user with credential-creation rights who can set a custom Bedrock runtime endpoint. Instances that do not use these nodes or restrict credential creation to trusted users are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aitooling","awsbedrock","medium","n8n","npm","selfhosted","ssrf"],"campaign_type":null,"search_a":"'aw':1A 'bedrock':2A 'custom':8A 'endpoint':10A 'g333':13A,18A 'g82p':15A,20A 'ghsa':12A,17A 'ghsa-g333-hr44-g82p':11A,16A 'hr44':14A,19A 'n8n':21A,22A,23A 'node':3A 'protect':6A 'runtim':9A 'skip':4A 'ssrf':5A","search_b":"'address':73B 'ai':25B 'ai-tool':24B 'aw':28B,36B,62B 'aws-bedrock':27B 'bedrock':29B,37B,48B 'block':72B 'bypass':51B 'chat':38B 'creat':60B 'credenti':63B 'custom':47B 'embed':41B 'endpoint':50B 'error':84B 'host':33B 'intern':70B 'let':45B 'make':65B 'model':39B 'n8n':30B,44B,52B,66B 'node':42B,83B 'protect':55B 'request':68B 'respons':80B 'runtim':49B 'see':75B 'self':32B 'self-host':31B 'send':67B 'ssrf':34B,54B 'start':77B 'tool':26B 'user':57B","search_c":"'2.47.6':165C '2.48.3':166C '3.2.2':168C 'access':200C 'address':136C,235C 'administr':190C 'appli':220C 'audit':206C 'aw':87C,93C,98C,124C,207C 'bedrock':88C,94C,103C,213C 'block':135C 'chat':89C 'connect':228C 'consid':192C 'control':224C 'could':121C,126C,145C 'creat':122C 'credenti':99C,125C,208C 'custom':102C,212C 'embed':92C 'endpoint':105C,109C,129C,215C 'error':155C 'expect':219C 'fix':161C 'follow':194C 'fulli':202C,240C 'go':112C 'host':232C 'immedi':188C 'impact':85C 'instanc':199C 'intern':132C,234C 'issu':158C 'later':178C 'let':96C 'level':223C 'make':138C 'measur':254C 'member':119C 'mitig':196C,253C 'model':90C 'n8n':114C,139C,163C,198C,231C 'network':222C 'network-level':221C 'node':95C,154C 'one':173C 'otherwis':134C 'outbound':227C 'patch':156C 'point':127C 'possibl':189C 'protect':117C 'remedi':180C,241C 'remov':210C 'request':106C,141C 'respons':151C 'restrict':197C,226C 'risk':243C 'runtim':104C,214C 'see':146C 'send':140C 'set':100C 'short':251C 'short-term':250C 'ssrf':116C 'start':148C 'temporari':195C 'term':252C 'trust':203C 'upgrad':171C,185C 'use':248C 'user':169C,204C 'version':164C,176C 'vulner':182C 'workaround':183C,237C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:55:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-g333-hr44-g82p","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-g333-hr44-g82p","severity":"medium","published_at":"2026-11-13T10:55:56+00:00","modified_at":"2026-11-13T10:55:56+00:00","first_seen_at":"2026-11-13T11:06:24+00:00","fetched_at":"2026-11-13T11:06:24+00:00","note":null}],"documents":[{"id":145546,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-g333-hr44-g82p","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}