EUVD-2026-56094
GHSA-xv2r-whj9-7vqh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible bypass requiring low-privilege auth; scope changes to internal systems with high confidentiality and low integrity impact from arbitrary internal requests.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection, exposing internal services and reading responses back through the workflow.
AnalysisAI
SSRF protection bypass in n8n's MCP Client node allows any authenticated user with workflow creation or editing rights to reach internal or blocked hosts and read responses back through the workflow. The MCP Client node neither routes outbound requests through n8n's SSRF protection layer nor pins the resolved IP address after DNS resolution, undermining the platform's intended network isolation guarantees. Vendor-released patches exist in versions 2.31.5 and 2.32.1; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
n8n is an open-source workflow automation platform distributed as the npm package n8n-io/n8n (CPE: cpe:2.3:a:n8n-io:n8n). The MCP (Model Context Protocol) Client node is a built-in workflow node that makes outbound HTTP/network requests to user-supplied endpoints. The root cause is CWE-918 (Server-Side Request Forgery): the MCP Client node was implemented to issue outbound requests directly rather than passing them through n8n's SSRF protection middleware, and it does not pin the resolved IP address at connection time, leaving a DNS rebinding window. This means that even when an operator has enabled SSRF protection - the feature designed to prevent the server from contacting internal RFC-1918 or link-local ranges - requests originating from the MCP Client node bypass those controls entirely. The CVSS 4.0 vector reflects this by assigning high subsequent-system confidentiality and integrity impact (SC:H/SI:H), capturing access to internal infrastructure beyond the n8n application boundary itself.
RemediationAI
The primary fix is to upgrade n8n to version 2.31.5 (for those on the 2.31.x branch) or 2.32.1 (for those on the 2.32.x branch) or any later release; the fix is confirmed by commit f69dfc6dd2178a14ea1624d2e1d403c2e755042f and the GHSA advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-vhf8-cg2h-cg3p. If immediate upgrade is not possible, three temporary mitigations are available per the vendor, each with trade-offs: first, restrict n8n instance access to fully trusted users only - this reduces the exploitable population but does not eliminate the vulnerability for those users; second, disable the MCP Client node by adding it to the NODES_EXCLUDE environment variable (e.g., NODES_EXCLUDE=n8n-nodes-base.mcpClientTool), which prevents exploitation at the cost of losing MCP Client functionality in all workflows; third, restrict network egress from the n8n host at the network perimeter to block RFC-1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local (169.254.0.0/16) ranges - this is the most effective compensating control for cloud environments where metadata services are reachable, but may require firewall rule changes and will not protect against SSRF to other internal services within the allowed egress range. None of these workarounds fully eliminate the vulnerability.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today