{"data":{"id":"ac0cccf5-6e04-40d7-9a9b-c2e88c69ad5e","title":"GHSA-vhf8-cg2h-cg3p: n8n: SSRF Protection Bypass via MCP Client Node","summary":"The MCP Client node in n8n sent requests to user-supplied endpoints without routing them through SSRF protection or pinning the resolved address. An authenticated user who could create or edit a workflow could make the server connect to internal or blocked hosts and read the responses back through the workflow. The issue affects instances with SSRF protection enabled.","solution":"Fixed in n8n versions 2.31.5 and 2.32.1; upgrade to one of these or later. If upgrading is not immediately possible, temporary mitigations include restricting instance access to fully trusted users only, disabling the MCP Client node by adding it to the `NODES_EXCLUDE` environment variable, and restricting network egress from the n8n host to block internal and link-local address ranges. These workarounds do not fully remediate the risk and should only be short-term measures.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-vhf8-cg2h-cg3p","publishedAt":"2026-07-22T22:07:04.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@< 2.31.5 (fixed: 2.31.5)","n8n@>= 2.32.0, < 2.32.1 (fixed: 2.32.1)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n","MCP Client node"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-vhf8-cg2h-cg3p"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-22T22:07:04.000Z","fixReleasedAt":"2026-07-22T10:18:23.590Z","daysToFix":0,"fixCheckedAt":"2026-10-29T21:32:52.594Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"2.31.5","matchedVersion":"2.31.5","fixReleasedAt":"2026-07-22T10:24:16.316Z","daysToFix":0,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:52.446Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.32.1","matchedVersion":"2.32.1","fixReleasedAt":"2026-07-22T10:18:23.590Z","daysToFix":0,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:52.446Z"}]}}