GHSA-vhf8-cg2h-cg3p CVE-2026-72768
n8n: SSRF Protection Bypass via MCP Client Node
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.40%
- Chance of exploitation in the next 30 days. Higher than 33.82% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
2.32.1- Upgrade n8n to this version or later
Description
Impact
On an n8n instance with SSRF protection enabled, the MCP Client node sent requests to a user-supplied endpoint without routing them through that protection and without pinning the resolved address. An authenticated user who could create or edit a workflow could therefore cause the server to connect to internal or otherwise blocked hosts and read the responses back through the workflow, exposing internal services the SSRF protection was meant to protect.
Patches
The issue has been fixed in n8n versions 2.31.5 and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Disable the MCP Client node by adding it to the
NODES_EXCLUDEenvironment variable. - Restrict network egress from the n8n host to block access to internal and link-local address ranges at the network level.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
n8n npm → 2.32.1
- npm
npm install n8n@2.32.1- yarn
yarn add n8n@2.32.1- pnpm
pnpm add n8n@2.32.1
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:L
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- High
- Integrity (subsequent systems)
- High
- Availability (subsequent systems)
- Low
CVSS 3.1 8.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-v98v-ff95-f3cp n8n Vulnerable to Remote Code Execution via Expression Injection | High Known exploited | Also affects n8n |
| GHSA-qgpw-8g46-w95v n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read | Medium | Also affects n8n |
| GHSA-65xw-2v52-jhxc n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter | Medium | Also affects n8n |
| GHSA-pq6c-vh67-xpm3 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check | Medium | Also affects n8n |
| GHSA-cqr2-h44g-v75v n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints | Medium | Also affects n8n |
| GHSA-pf83-w3f9-8m37 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions | Medium | Also affects n8n |
| GHSA-6xcw-7xm6-48c6 n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution | High | Also affects n8n |
| GHSA-34ff-336r-5q23 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node | Medium | Also affects n8n |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor