n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths
Priority LOW 33CWE-367Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed n8n-mcp (czlonkowski): 2.50.2n8n-mcp (npm): 2.50.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| czlonkowski | n8n-mcp | 2.18.7 to before 2.50.2 | 2.50.2 | Patch available | CNA |
| — | n8n-mcp (npm) | 2.18.7 to before 2.50.2 | 2.50.2 | Patch available | GHSA-cmrh-wvq6-wm9r |
- n8n-mcp Vendorczlonkowski Affected 2.18.7 to before 2.50.2 Fixed in 2.50.2 Patch available CNA
- n8n-mcp (npm) Vendor— Affected 2.18.7 to before 2.50.2 Fixed in 2.50.2 Patch available GHSA-cmrh-wvq6-wm9r
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:* | 2.18.7 to before 2.50.2 | Vulnerable | czlonkowski |
- cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:* Versions 2.18.7 to before 2.50.2 Vulnerable ·czlonkowski
Remediation
- Fix · CNA n8n-mcp (czlonkowski) Fixed in 2.50.2
- Fix · GHSA-cmrh-wvq6-wm9r n8n-mcp (npm) Fixed in 2.50.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44694
- 2026-10-03 Alias added: GHSA-cmrh-wvq6-wm9r
References
Advisory 2
More czlonkowski N8n-mcp vulnerabilities
- TI-2026-38986 n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments CVSS 3.1CRITICAL 9.9
- TI-2026-28830 n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode CVSS 3.1HIGH 8.5
- TI-2026-30738 n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders CVSS 3.1HIGH 8.5
- TI-2026-33447 Improper access control in czlonkowski n8n-mcp CVSS 3.1HIGH 8.1
- TI-2026-30081 n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests CVSS 3.1MEDIUM 5.3
- TI-2026-33331 n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-44694 · CVE Program
- CVE-2026-44694 · NVD
- FIRST EPSS
- GHSA-cmrh-wvq6-wm9r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences