Most recent entries from all

BREW-n8n-mcp-CVE-2026-44694 — n8n-mcp webhook and API client paths has an authenticated SSRF

2026-10-08T01:31:10.617776+00:00

Affected: Homebrew: n8n-mcp

### Summary

Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client (`N8N_API_URL`), and per-request URLs supplied via the `x-n8n-url` header in multi-tenant HTTP mode.

### Impact

A caller with access to the MCP session can drive HTTP requests from the n8n-mcp host to internal services and cloud metadata endpoints that the SSRF gate is meant to block. The response body is returned to the caller, making internal-service enumeration and credential theft immediate without any out-of-band channel.

- **Multi-tenant HTTP deployments** where tenants share an `AUTH_TOKEN`: any tenant with valid credentials can reach the operator's cloud metadata service and exfiltrate temporary IAM / GCP service account / Azure managed-identity credentials. - **Single-tenant deployments**: indirect prompt injection through tool arguments reaches the same surface; an attacker who can influence the LLM's tool calls can read internal services from the n8n-mcp host. - **Stdio deployments** are reachable via the same prompt-injection path.

### Patched Versions

Fixed in `n8n-mcp@2.50.2`.

**Note for operators:** The same SSRF gate that previously covered webhook URLs now also covers the n8n API client base URL. If `N8N_API_URL` points at `http://localhost:5678` (n8n on the same host) or an RFC1918 address (n8n on the same private network), set `WEBHOOK_SECURITY_MODE=moderate` (allows localhost, still blocks RFC1918 and cloud metadata) or `WEBHOOK_SECURITY_MO…

EUVD-2026-316823

2026-10-08T01:31:10.617850+00:00

EUVD-2026-316823

fkie_cve-2026-44694

2026-10-08T01:31:10.617868+00:00

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.

GHSA-cmrh-wvq6-wm9r — n8n-mcp webhook and API client paths has an authenticated SSRF

2026-10-08T01:31:10.617891+00:00

Affected: npm: n8n-mcp

### Summary

Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client (`N8N_API_URL`), and per-request URLs supplied via the `x-n8n-url` header in multi-tenant HTTP mode.

### Impact

### Patched Versions

Fixed in `n8n-mcp@2.50.2`.