n8n-MCP SSRF Vulnerability (CVE-2026-42449) — High Severity

Understanding the High Severity Risk in n8n-MCP

A significant security flaw has been identified in n8n-MCP, an MCP server that provides AI assistants with access to n8n node documentation, properties, and operations. This vulnerability, tracked as CVE-2026-42449, is a type of Server-Side Request Forgery (SSRF) and carries a High severity rating. It specifically affects versions 2.47.4 through 2.47.13 of the software.

The core issue lies within n8n-MCP’s synchronous URL validator, SSRFProtection.validateUrlSync(), which failed to adequately check IPv6 addresses. This oversight meant that specially crafted IPv4-mapped IPv6 addresses, such as http://[::ffff:169.254.169.254], could slip past crucial security checks designed to prevent access to cloud-metadata, localhost, and private-IP ranges.

An attacker who can provide a malicious n8nApiUrl value could exploit this flaw. This would enable them to force the n8n-MCP server to initiate HTTP requests to sensitive internal targets like cloud metadata endpoints or private network services. What makes this particularly dangerous is that the server would not only make these requests but also return the response bodies to the attacker. Furthermore, the x-n8n-api-key, a sensitive API key, would be forwarded in the header to the attacker-controlled destination. This non-blind SSRF scenario could lead to extensive information disclosure and potentially deeper network compromise.

Projects that embed n8n-MCP as an SDK using N8NDocumentationMCPServer or N8NMCPEngine with user-supplied InstanceContext are primarily at risk. The first-party HTTP server deployment was less affected because it employed a second, asynchronous validator that could catch these IPv6 addresses.

CVE Details

  • Product: n8n-MCP
  • Published Date: May 7, 2026
  • Severity: High (CVSS 8.5)
  • Status: Analyzed

Affected Products

The vulnerability impacts n8n-MCP versions 2.47.4 through 2.47.13.

Current Status

This vulnerability is currently in an “Analyzed” status, meaning it has been reviewed and its details are publicly available. A fix has been released.

Severity Level

Rated as HIGH, this vulnerability carries a CVSS score of 8.5. This high rating indicates that the flaw could be exploited with significant impact, potentially leading to unauthorized access to sensitive data and internal network resources.

Possible Solutions

The good news is that a fix for CVE-2026-42449 is available. Users are strongly advised to:

  • Upgrade Immediately: Update your n8n-MCP installation to version 2.47.14 or newer. This version addresses the IPv6 validation bypass.

If an immediate upgrade isn’t feasible, the following workarounds can help mitigate the risk:

  • Validate URLs: Implement strict URL validation on your end before passing any URLs to the n8n-MCP SDK.
  • Restrict Egress: Apply network-layer restrictions to limit outbound traffic from the server. This can prevent the server from reaching unauthorized internal or external endpoints.
  • Reject User-Controlled n8nApiUrl Values: Avoid allowing users to supply arbitrary n8nApiUrl values, as this is the primary vector for exploitation.

References

https://github.com/czlonkowski/n8n-mcp/commit/9639f757853149f0cb16663cc8b6b6468f27a25f
https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-56c3-vfp2-5qqj

Tags
Alex Joseph
Alex Joseph

Alex Joseph is a Senior Support Staff professional with deep experience in server management, web hosting technologies, and cybersecurity operations. He works daily with Linux servers, cloud platforms, performance tuning, and security hardening, giving him strong real-world technical knowledge. Along with his support role, he write about security best practices, hosting infrastructure, and software management.

Related Posts