n8n MCP Client Node SSRF Protection Bypass

Technical Analysis

The MCP Client node in n8n is intended to route outbound requests through SSRF protection logic that blocks access to internal/private IP ranges and disallowed hosts. This flaw allows a crafted workflow configuration to circumvent that filtering, so requests are dispatched directly to internal or blocked endpoints. Because MCP Client nodes are used to connect n8n workflows to external tools and agent servers, the bypass effectively turns the automation platform into an SSRF proxy, letting an authenticated attacker read back responses from internal services (metadata endpoints, internal APIs, admin panels, etc.) via the workflow execution results. The entry point is authenticated workflow creation/editing, and the impact crosses the trust boundary between the n8n orchestration layer and internal infrastructure that was assumed unreachable.

Affected Systems

n8n; protocols: MCP

Detection Signatures

• n8n workflow execution logs showing MCP Client node requests to RFC1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost, or cloud metadata endpoints (169.254.169.254)
• Unexpected outbound connections from n8n host to internal-only services correlated with workflow execution timestamps
• MCP Client node configurations referencing internal hostnames/IPs or using URL obfuscation techniques (IP encoding, DNS rebinding domains, redirects)
• Anomalous spikes in workflow executions targeting non-standard/internal endpoints from a single authenticated user account

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n version 2.32.1 or later, which fixes the SSRF protection bypass in the MCP Client node.

2. 2

   Restrict authenticated user privileges

   Limit which users can create or edit workflows using the MCP Client node, especially in multi-tenant or shared n8n deployments.

3. 3

   Network-level egress controls

   Enforce firewall/network segmentation so the n8n host cannot reach sensitive internal services or cloud metadata endpoints regardless of application-layer SSRF protections.

4. 4

   Audit existing workflows

   Review current MCP Client node configurations for suspicious target hosts, IP addresses, or URLs pointing to internal infrastructure.

5. 5

   Monitor and alert

   Deploy logging/alerting on outbound requests from n8n to private IP ranges or metadata services to detect exploitation attempts.