CVE-2026-72768 is an SSRF protection bypass in the n8n MCP Client node. It sent requests to a user-chosen endpoint without using the instance's SSRF protection, so a workflow author could reach internal hosts. The record scores it 8.3, High. Upgrade to 2.31.5 or 2.32.1.
What's affected
The advisory covers the 2.x line only: anything before 2.31.5, or before 2.32.1 on the 2.32 line. The record for this CVE says before 2.32.1. The GitHub advisory lists 2.31.5 and 2.32.1 as patched, with no 1.x fix.
The advisory sets the condition clearly. The instance has SSRF protection enabled, and the MCP Client node sent its requests without routing them through that protection or pinning the resolved address. An authenticated user who can create or edit a workflow could then make the server connect to internal or blocked hosts and read the replies through the workflow.
The weakness class is CWE-918, server-side request forgery.
How to check if you're exposed
Find the version of every n8n instance you run, including containers and any copy bundled in another product.
n8n --version
docker exec <container-name> n8n --version
npm ls n8n
If the version is below the patched release for your line, you are in the affected range. Remember that n8n often runs as a base image tag in Docker or Kubernetes, so check image tags in your manifests as well as running hosts. A dependency scan of the repository that holds your deployment files will surface pinned n8n packages. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for what it finds.
Your 1.x instances are not listed in the advisory for this CVE. Then see whether the MCP Client node is in use at all, and whether the n8n host can reach internal services or the cloud metadata address. Your network team can tell you what that host can talk to. That reach decides how much a bypass is worth to an attacker.
What to do now
- Upgrade n8n to 2.31.5 or 2.32.1 or later.
- If you cannot upgrade now, disable the MCP Client node by adding it to the NODES_EXCLUDE environment variable.
- Limit instance access to fully trusted users.
- Block access from the n8n host to internal and link-local address ranges at the network level, as the advisory suggests.
- Do not rely on application level SSRF protection alone. Keep network controls in place around the host.
- List the workflows that use the MCP Client node and confirm that each still needs it.
Why it matters
SSRF protection works only if every outbound request path goes through it. A feature added later, like an MCP client, is easy to leave out. Once one path skips the check, the whole control means less than it claims, because an author can pick the path that skips it.
The sources disagree on severity. The record rates it 8.3 High under CVSS 3.1. The GitHub advisory calls it Moderate at 6.4 under CVSS 4.0, and VulnCheck lists medium at 6.4. The record also covers a wider reach, with high confidentiality and integrity impact, while the advisory focuses on reading responses back. Use the higher figure if your n8n host sits close to sensitive internal services, and the lower one if it is isolated. No source says exploitation has been seen, and it is not on the CISA KEV list.
Quick check
Does CVE-2026-72768 affect n8n 1.x?
The GitHub advisory lists only versions before 2.31.5 and before 2.32.1. The record says before 2.32.1. It does not list a 1.x fix.
What does the bypass allow?
A user who can edit workflows could make the server reach internal or blocked hosts and read the responses through the workflow.
Sources
Last reviewed: 18 October 2026.
