The vulnerability exists in the MCP Client node of n8n before version 2.32.1 and permits authenticated users to bypass the system’s SSRF protection. This is a Server‑Side Request Forgery (SSRF) bypass, classified as CWE‑918. By assembling a workflow that targets internal or otherwise blocked destinations, an attacker can cause the n8n server to issue HTTP requests to those endpoints and retrieve the responses within the workflow result. This flaw enables an attacker to discover and potentially interact with internal services that are normally shielded by the SSRF guard, compromising confidentiality and possibly revealing sensitive data.

All deployments of the n8n automation platform using any release prior to 2.32.1 are susceptible. The impact is limited to instances that expose the MCP Client node to users with write or execution permissions in workflows.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalogue. Exploitation requires that the attacker be an authenticated user with the ability to create or modify workflows, and the attacker must construct a workflow that targets the intended internal or blocked host. Because the bypass occurs after the standard SSRF checks, the attack largely depends on the value of the user’s workflow permissions rather than a public-facing vulnerability.