In today’s digital landscape, keeping our systems secure is paramount. Even tools designed to streamline operations can, at times, harbor hidden dangers. This brings us to a significant security flaw recently identified in n8n-MCP, a valuable component for integrating AI assistants with n8n workflows.
n8n-MCP serves as an MCP server, enabling AI assistants to access n8n node documentation, properties, and operations. However, a critical vulnerability has been discovered that could pose a serious risk to affected systems.
CVE Details
- CVE ID: CVE-2026-44694
- Published Date: May 8, 2026
- Severity: CRITICAL
- Status: Analyzed
Affected Products
The authenticated Server-Side Request Forgery (SSRF) vulnerability impacts n8n-MCP versions from 2.18.7 up to, but not including, 2.50.2. Specifically, the issue affects the webhook trigger tools, the n8n API client (when configured via the N8N_API_URL environment variable), and per-request URLs supplied through the x-n8n-url header in multi-tenant HTTP mode.
Current Status
The good news is that this vulnerability has been thoroughly analyzed, and a patch is readily available. The issue has been officially addressed and fixed in n8n-MCP version 2.50.2.
Severity Level
Rated with a CRITICAL severity (CVSS Score 9.1), this authenticated Server-Side Request Forgery (SSRF) vulnerability should not be taken lightly. An SSRF flaw allows an attacker to compel the server-side application to make requests to an arbitrary domain of the attacker’s choosing, even if the target server is protected by a firewall. This means an attacker could potentially access internal resources, sensitive data, or interact with other systems within your network, bypassing existing security measures. The “authenticated” aspect means that an attacker would first need valid credentials to exploit this vulnerability, but once authenticated, the impact could be severe.
Possible Solutions
The most effective and strongly recommended solution is to immediately upgrade your n8n-MCP installation to version 2.50.2 or later. This version contains the necessary security fixes to prevent exploitation of CVE-2026-44694.
It’s also important to note that the n8n API client now includes validation for the N8N_API_URL through the same SSRF protection mechanism used for user-supplied webhook URLs. If you are running n8n on the same host as n8n-MCP (e.g., using N8N_API_URL=http://localhost:5678 or an RFC1918 address), you must configure WEBHOOK_SECURITY_MODE=moderate after upgrading. This setting allows localhost connections while still blocking access to sensitive cloud metadata. For production deployments with a publicly accessible n8n URL, the default strict mode remains unchanged and is recommended.
References
https://github.com/czlonkowski/n8n-mcp/commit/bcaba839409d470abeb4a6ad9b361b553a1098eb
https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.50.2
https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-cmrh-wvq6-wm9r
