High severity8.3NVD Advisory· Published Aug 11, 2026· Updated Sep 1, 2026
CVE-2026-72768
CVE-2026-72768
Description
n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection, exposing internal services and reading responses back through the workflow.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/n8n-io/n8n/security/advisories/GHSA-vhf8-cg2h-cg3pnvdMitigationVendor Advisory
- www.vulncheck.com/advisories/n8n-before-ssrf-protection-bypass-via-mcp-clientnvdThird Party Advisory
News mentions
1- N8n: 16 Vulnerabilities Including RCE and SQLi Disclosed in Single BatchVypr Intelligence · Aug 11, 2026