AIKIDO-2026-10739

TL;DR

Caller-controlled fragments were interpolated into outbound n8n API paths without strict segment validation and encoding, which opens route manipulation and traversal-style pivots against backend endpoints. Outbound webhook and related HTTP calls still followed redirects by default, so an allowed URL could bounce toward internal or unintended hosts during SSRF checks. Telemetry payloads could retain sensitive fields before persistence. The release validates or encodes path segments, disables redirect following for those outbound flows, and redacts telemetry content before storage.