CVE-2026-72773

CVE-2026-72773 affects n8n versions before 2.31.5 and 2.32.x before 2.32.1, due to a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement, expanding to locations outside the configured directory and re...

CVE-2026-72768 n8n before 2.32.1 SSRF Protection Bypass via MCP Client

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...