n8n: SSRF Protection Bypass via MCP Client Node
A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the MCP Client node of n8n. Authenticated users with workflow creation or editing permissions could exploit this to make the server connect to internal or blocked hosts, bypassing SSRF protections and potentially exposing internal services. The issue is fixed in n8n versions 2.31.5 and 2.32.1. Temporary mitigations include restricting access to trusted users, disabling the MCP Client node, and limiting network egress to internal address ranges.
AI Analysis
Technical Summary
The MCP Client node in n8n versions prior to 2.31.5 and between 2.32.0 and before 2.32.1 sends requests to user-supplied endpoints without routing them through the SSRF protection mechanism or pinning the resolved IP address. This allows an authenticated user who can create or edit workflows to cause the server to connect to internal or otherwise blocked hosts and read the responses, effectively bypassing SSRF protections. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).
Potential Impact
An authenticated user with workflow creation or editing privileges can bypass SSRF protections to make the n8n server connect to internal or restricted network hosts and retrieve their responses. This exposure can lead to unauthorized access to internal services that the SSRF protection was designed to block, potentially leaking sensitive internal information.
Mitigation Recommendations
A fix is available in n8n versions 2.31.5 and 2.32.1; users should upgrade to one of these versions or later. If immediate upgrading is not possible, administrators should restrict n8n instance access to fully trusted users, disable the MCP Client node via the NODES_EXCLUDE environment variable, and restrict network egress from the n8n host to block access to internal and link-local address ranges. These workarounds are temporary and do not fully remediate the risk.
n8n: SSRF Protection Bypass via MCP Client Node
Description
A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the MCP Client node of n8n. Authenticated users with workflow creation or editing permissions could exploit this to make the server connect to internal or blocked hosts, bypassing SSRF protections and potentially exposing internal services. The issue is fixed in n8n versions 2.31.5 and 2.32.1. Temporary mitigations include restricting access to trusted users, disabling the MCP Client node, and limiting network egress to internal address ranges.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The MCP Client node in n8n versions prior to 2.31.5 and between 2.32.0 and before 2.32.1 sends requests to user-supplied endpoints without routing them through the SSRF protection mechanism or pinning the resolved IP address. This allows an authenticated user who can create or edit workflows to cause the server to connect to internal or otherwise blocked hosts and read the responses, effectively bypassing SSRF protections. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).
Potential Impact
An authenticated user with workflow creation or editing privileges can bypass SSRF protections to make the n8n server connect to internal or restricted network hosts and retrieve their responses. This exposure can lead to unauthorized access to internal services that the SSRF protection was designed to block, potentially leaking sensitive internal information.
Mitigation Recommendations
A fix is available in n8n versions 2.31.5 and 2.32.1; users should upgrade to one of these versions or later. If immediate upgrading is not possible, administrators should restrict n8n instance access to fully trusted users, disable the MCP Client node via the NODES_EXCLUDE environment variable, and restrict network egress from the n8n host to block access to internal and link-local address ranges. These workarounds are temporary and do not fully remediate the risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vhf8-cg2h-cg3p
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a6150cc9c2644c7f8da0161
Added to database: 07/22/2026, 23:22:52 UTC
Last enriched: 07/22/2026, 23:28:02 UTC
Last updated: 07/22/2026, 23:28:02 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.