AIKIDO-2026-924507

n8n-mcp is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)GHSA-2x5j-hrmv-ccrq Published Aug 11, 2026

Low Risk

This Affects:

n8n-mcp

2.16.3 - 2.68.4

Fixed in 2.69.0

Are you affected? Scan for Free

TL;DR

The outbound URL validator in n8n-mcp classifies only part of the IPv6 link-local range as non-public, leaving a subset of link-local destinations treated as globally routable. In deployments where a client can influence a URL the server requests a request can be directed at a link-local destination the validator is expected to refuse. Before the fix, the blocklist matches these ranges incompletely, so some non-globally-reachable addresses pass validation. The fix matches each blocked range across its full span and extends outbound filtering to further IANA special-purpose address blocks that are not globally reachable.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and a client can influence an outbound URL the server requests, for example multi-tenant HTTP mode or webhook, form, and chat trigger URLs.