---
id: "GHSA-g333-hr44-g82p"
page: "https://infrastack.ai/live/GHSA-g333-hr44-g82p"
kind: "vulnerability"
aliases: ["GHSA-g333-hr44-g82p"]
title: "AWS Bedrock Nodes Skip SSRF Protection for Custom Runtime Endpoints"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "n8n", "fixed": ["2.48.3"], "affected": "< 2.48.3", "ecosystem": "npm"}, {"name": "n8n", "fixed": ["2.47.6"], "affected": "< 2.47.6", "ecosystem": "npm"}, {"name": "n8n", "fixed": ["3.2.2"], "affected": "< 3.2.2", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "aws-bedrock", "n8n", "self-hosted", "ssrf"]
not_affected_if: ["managed-hosting", "no-bedrock-nodes"]
published_at: "2026-11-13T10:55:56+00:00"
first_seen_at: "2026-11-13T11:06:24+00:00"
updated_at: "2026-11-13T11:06:57+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-g333-hr44-g82p", "first_seen_at": "2026-11-13T11:06:24+00:00"}]
exploit_sources: []
---

# AWS Bedrock Nodes Skip SSRF Protection for Custom Runtime Endpoints

Link for people: https://infrastack.ai/live/GHSA-g333-hr44-g82p (this .md is for agents)

The AWS Bedrock Chat Model and Embeddings nodes in n8n let a custom Bedrock runtime endpoint bypass n8n's SSRF protection. A user who can create an AWS credential can make n8n send requests to internal or blocked addresses and see the start of the response in the node error.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 2.48.3 fixed 2.48.3
- npm:n8n affected < 2.47.6 fixed 2.47.6
- npm:n8n affected < 3.2.2 fixed 3.2.2

## How to check

- Check the n8n version with `n8n --version` or the package in `package.json`; versions below `2.47.6`, `2.48.3` or `3.2.2` on their respective lines are affected.
- Review AWS credentials in n8n for any custom Bedrock Runtime Endpoint that is not expected.

## Fix

- n8n `2.47.6` (2.47 line)
- n8n `2.48.3` (2.48 line)
- n8n `3.2.2` (3.x line)

## Timeline

- 2026-11-13T11:06:24+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-g333-hr44-g82p

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-g333-hr44-g82p

## From the sources

## Impact

The AWS Bedrock Chat Model and Embeddings AWS Bedrock nodes let an AWS credential set a custom Bedrock runtime endpoint. Requests to that endpoint did not go through n8n's SSRF protection. A member who could create an AWS credential could point the endpoint at an internal or otherwise blocked address and make n8n send requests to it, and could see the start of the response in the node error.

## Patches

The issue has been fixed in n8n versions 2.47.6, 2.48.3 and 3.2.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Audit AWS credentials and remove any custom Bedrock Runtime Endpoint that is not expected.
- Apply network-level controls to restrict outbound connections from the n8n host to internal addresses.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_