CVE-2026-72768: n8n SSRF Protection Bypass Vulnerability

CVE-2026-72768 Overview

CVE-2026-72768 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in n8n, an open-source workflow automation platform. The flaw resides in the Model Context Protocol (MCP) Client node in n8n versions before 2.32.1. Authenticated users can craft workflows that send HTTP requests to internal or blocked hosts without traversing the platform's SSRF protection layer. Successful exploitation exposes internal services and returns response data through the workflow output. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can reach internal-only services, cloud metadata endpoints, and other blocked hosts, then read the responses back through workflow execution results.

Affected Products

n8n workflow automation platform, all versions prior to 2.32.1
Self-hosted n8n deployments exposing the MCP Client node to authenticated users
n8n Cloud tenants running vulnerable versions before patch rollout

Discovery Timeline

2026-08-11 - CVE-2026-72768 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72768

Vulnerability Analysis

n8n implements SSRF protection to prevent workflow nodes from initiating outbound requests to internal network ranges, loopback addresses, and other blocked destinations. This protection normally intercepts and validates request targets before HTTP calls are dispatched.

The MCP Client node, which allows workflows to communicate with Model Context Protocol servers, does not route its outbound requests through the shared SSRF protection pipeline. Any authenticated user with permission to create or edit workflows can point the MCP Client at an arbitrary URL, including RFC1918 addresses, localhost, or cloud provider metadata endpoints such as 169.254.169.254.

Because the MCP Client returns responses into workflow execution data, attackers can read the results directly. This turns the platform into a blind and non-blind SSRF proxy against the network segments accessible to the n8n server.

Root Cause

The root cause is inconsistent enforcement of SSRF controls across node types. The centralized URL validation and network filtering applied to HTTP Request and similar nodes was not invoked in the MCP Client node's request path, leaving a bypass route to internal resources.

Attack Vector

Exploitation requires an authenticated account with workflow creation privileges. The attacker configures an MCP Client node with a target URL pointing to an internal service, executes the workflow, and retrieves the response. See the GitHub Security Advisory GHSA-vhf8-cg2h-cg3p and the VulnCheck Advisory for advisory details.

No exploitation code is required beyond configuring a workflow node through the standard UI or API. No public proof-of-concept has been released.

Detection Methods for CVE-2026-72768

Indicators of Compromise

Workflow definitions containing MCP Client nodes with URLs targeting private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local addresses (169.254.0.0/16).
n8n outbound connections from the application host to cloud instance metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Unexpected workflow execution logs referencing MCP Client requests to internal hostnames or non-public services.

Detection Strategies

Audit stored workflow JSON in the n8n database for n8n-nodes-base.mcpClient or equivalent MCP Client node types with suspicious URL parameters.
Correlate authenticated n8n user activity with network telemetry showing outbound requests to internal subnets originating from the n8n server.
Alert on workflow creation or edit events performed by non-administrative users that introduce MCP Client nodes.

Monitoring Recommendations

Forward n8n audit logs and workflow execution logs to a centralized SIEM for correlation with network flow data.
Monitor egress from n8n hosts and flag any traffic destined for RFC1918 ranges, loopback, or cloud metadata IPs.
Track n8n version inventory continuously and alert when any instance reports a version below 2.32.1.

How to Mitigate CVE-2026-72768

Immediate Actions Required

Upgrade all n8n instances to version 2.32.1 or later, which restores SSRF protection enforcement for the MCP Client node.
Review existing workflows for MCP Client nodes and remove or reconfigure any that target internal or unexpected hosts.
Restrict workflow creation and editing permissions to trusted users while patching is in progress.

Patch Information

Upgrade to n8n 2.32.1 or later. The fix routes MCP Client node requests through the same SSRF validation applied to other HTTP-capable nodes. Details are published in the GitHub Security Advisory GHSA-vhf8-cg2h-cg3p.

Workarounds

Disable or block the MCP Client node in environments where an immediate upgrade is not possible.
Enforce network-layer egress filtering on the n8n host to deny outbound connections to internal subnets, loopback, and cloud metadata endpoints.
Reduce the number of accounts with workflow creation privileges and require review of new workflows before execution.

bash

# Example egress restriction using iptables on the n8n host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT