https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 21:09:47 +0000 https://cve.radiocsirt.org/vuln/ghsa-75hx-xj24-mqrw <p><strong>Affected:</strong> npm: n8n-mcp</p> <p>### Summary</p> <p>Several HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.</p> <p>### Impact</p> <p>An unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.</p> <p>### Patches</p> <p>Fixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.</p> <p>### Workarounds</p> <p>If you cannot upgrade immediately:</p> <p>- **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it. - **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.</p> <p>Upgrading to v2.47.6 is still strongly recommended.</p> <p>### Credit</p> <p>Reported by @yotampe-pluto.</p> <p><strong>Affected:</strong> npm: n8n-mcp</p> <p>### Summary</p> <p>Several HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.</p> <p>### Impact</p> <p>An unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.</p> <p>### Patches</p> <p>Fixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.</p> <p>### Workarounds</p> <p>If you cannot upgrade immediately:</p> <p>- **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it. - **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.</p> <p>Upgrading to v2.47.6 is still strongly recommended.</p> <p>### Credit</p> <p>Reported by @yotampe-pluto.</p> https://cve.radiocsirt.org/vuln/ghsa-75hx-xj24-mqrw