https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 01:25:41 +0000 https://cve.radiocsirt.org/vuln/brew-n8n-mcp-cve-2026-44694 <p><strong>Affected:</strong> Homebrew: n8n-mcp</p> <p>### Summary</p> <p>Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client (`N8N_API_URL`), and per-request URLs supplied via the `x-n8n-url` header in multi-tenant HTTP mode.</p> <p>### Impact</p> <p>A caller with access to the MCP session can drive HTTP requests from the n8n-mcp host to internal services and cloud metadata endpoints that the SSRF gate is meant to block. The response body is returned to the caller, making internal-service enumeration and credential theft immediate without any out-of-band channel.</p> <p>- **Multi-tenant HTTP deployments** where tenants share an `AUTH_TOKEN`: any tenant with valid credentials can reach the operator&#39;s cloud metadata service and exfiltrate temporary IAM / GCP service account / Azure managed-identity credentials. - **Single-tenant deployments**: indirect prompt injection through tool arguments reaches the same surface; an attacker who can influence the LLM&#39;s tool calls can read internal services from the n8n-mcp host. - **Stdio deployments** are reachable via the same prompt-injection path.</p> <p>### Patched Versions</p> <p>Fixed in `n8n-mcp@2.50.2`.</p> <p>**Note for operators:** The same SSRF gate that previously covered webhook URLs now also covers the n8n API client base URL. If `N8N_API_URL` points at `http://localhost:5678` (n8n on the same host) or an RFC1918 address (n8n on the same private network), set `WEBHOOK_SECURITY_MODE=moderate` (allows localhost, still blocks RFC1918 and cloud metadata) or `WEBHOOK_SECURITY_MO…</p> <p><strong>Affected:</strong> Homebrew: n8n-mcp</p> <p>### Summary</p> <p>Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client (`N8N_API_URL`), and per-request URLs supplied via the `x-n8n-url` header in multi-tenant HTTP mode.</p> <p>### Impact</p> <p>A caller with access to the MCP session can drive HTTP requests from the n8n-mcp host to internal services and cloud metadata endpoints that the SSRF gate is meant to block. The response body is returned to the caller, making internal-service enumeration and credential theft immediate without any out-of-band channel.</p> <p>- **Multi-tenant HTTP deployments** where tenants share an `AUTH_TOKEN`: any tenant with valid credentials can reach the operator&#39;s cloud metadata service and exfiltrate temporary IAM / GCP service account / Azure managed-identity credentials. - **Single-tenant deployments**: indirect prompt injection through tool arguments reaches the same surface; an attacker who can influence the LLM&#39;s tool calls can read internal services from the n8n-mcp host. - **Stdio deployments** are reachable via the same prompt-injection path.</p> <p>### Patched Versions</p> <p>Fixed in `n8n-mcp@2.50.2`.</p> <p>**Note for operators:** The same SSRF gate that previously covered webhook URLs now also covers the n8n API client base URL. If `N8N_API_URL` points at `http://localhost:5678` (n8n on the same host) or an RFC1918 address (n8n on the same private network), set `WEBHOOK_SECURITY_MODE=moderate` (allows localhost, still blocks RFC1918 and cloud metadata) or `WEBHOOK_SECURITY_MO…</p> https://cve.radiocsirt.org/vuln/brew-n8n-mcp-cve-2026-44694 https://cve.radiocsirt.org/vuln/euvd-2026-316823 EUVD-2026-316823 https://cve.radiocsirt.org/vuln/euvd-2026-316823 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44694 <p>n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.</p> <p>n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44694 https://cve.radiocsirt.org/vuln/ghsa-cmrh-wvq6-wm9r <p><strong>Affected:</strong> npm: n8n-mcp</p> <p>### Summary</p> <p>Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client (`N8N_API_URL`), and per-request URLs supplied via the `x-n8n-url` header in multi-tenant HTTP mode.</p> <p>### Impact</p> <p>A caller with access to the MCP session can drive HTTP requests from the n8n-mcp host to internal services and cloud metadata endpoints that the SSRF gate is meant to block. The response body is returned to the caller, making internal-service enumeration and credential theft immediate without any out-of-band channel.</p> <p>- **Multi-tenant HTTP deployments** where tenants share an `AUTH_TOKEN`: any tenant with valid credentials can reach the operator&#39;s cloud metadata service and exfiltrate temporary IAM / GCP service account / Azure managed-identity credentials. - **Single-tenant deployments**: indirect prompt injection through tool arguments reaches the same surface; an attacker who can influence the LLM&#39;s tool calls can read internal services from the n8n-mcp host. - **Stdio deployments** are reachable via the same prompt-injection path.</p> <p>### Patched Versions</p> <p>Fixed in `n8n-mcp@2.50.2`.</p> <p>**Note for operators:** The same SSRF gate that previously covered webhook URLs now also covers the n8n API client base URL. If `N8N_API_URL` points at `http://localhost:5678` (n8n on the same host) or an RFC1918 address (n8n on the same private network), set `WEBHOOK_SECURITY_MODE=moderate` (allows localhost, still blocks RFC1918 and cloud metadata) or `WEBHOOK_SECURITY_MO…</p> <p><strong>Affected:</strong> npm: n8n-mcp</p> <p>### Summary</p> <p>Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client (`N8N_API_URL`), and per-request URLs supplied via the `x-n8n-url` header in multi-tenant HTTP mode.</p> <p>### Impact</p> <p>A caller with access to the MCP session can drive HTTP requests from the n8n-mcp host to internal services and cloud metadata endpoints that the SSRF gate is meant to block. The response body is returned to the caller, making internal-service enumeration and credential theft immediate without any out-of-band channel.</p> <p>- **Multi-tenant HTTP deployments** where tenants share an `AUTH_TOKEN`: any tenant with valid credentials can reach the operator&#39;s cloud metadata service and exfiltrate temporary IAM / GCP service account / Azure managed-identity credentials. - **Single-tenant deployments**: indirect prompt injection through tool arguments reaches the same surface; an attacker who can influence the LLM&#39;s tool calls can read internal services from the n8n-mcp host. - **Stdio deployments** are reachable via the same prompt-injection path.</p> <p>### Patched Versions</p> <p>Fixed in `n8n-mcp@2.50.2`.</p> <p>**Note for operators:** The same SSRF gate that previously covered webhook URLs now also covers the n8n API client base URL. If `N8N_API_URL` points at `http://localhost:5678` (n8n on the same host) or an RFC1918 address (n8n on the same private network), set `WEBHOOK_SECURITY_MODE=moderate` (allows localhost, still blocks RFC1918 and cloud metadata) or `WEBHOOK_SECURITY_MO…</p> https://cve.radiocsirt.org/vuln/ghsa-cmrh-wvq6-wm9r