In the world of AI-driven automation, tools like n8n-MCP (Model Context Protocol) are essential for connecting AI assistants with powerful workflow capabilities. However, a significant security flaw has been discovered in n8n-mcp that could expose sensitive internal information if not addressed promptly.
This vulnerability, identified as a Server-Side Request Forgery (SSRF), essentially tricks the n8n-mcp server into making unauthorized requests on behalf of an attacker. Imagine giving a trusted assistant a note that, unbeknownst to them, contains instructions to reveal your private files to a malicious third party. That's the essence of an SSRF attack.
CVE Details
- Product: n8n-mcp
- CVE ID: CVE-2026-39974
- Published Date: April 9, 2026
- Severity: High
- Status: Analyzed
Affected Products
The Server-Side Request Forgery vulnerability specifically impacts versions of n8n-mcp prior to 2.47.4. If you are running an older version, your system could be at risk.
Current Status
The good news is that the vulnerability has been formally recognized and addressed. A fix is available, ensuring that updated systems can protect against this particular threat. The security advisory (GHSA-4ggg-h7ph-26qr) confirms that the issue has been resolved.
Severity Level
This vulnerability is rated as "High" severity due to the potential for significant data exposure. An authenticated attacker who holds a valid authentication token can force the n8n-mcp server to send HTTP requests to any web address. What makes this particularly dangerous is that the server then reflects the responses back to the attacker.
This means an attacker could gain access to highly sensitive data, including:
- Cloud instance metadata endpoints (like those from AWS, GCP, Azure, Alibaba, and Oracle). This data can often contain temporary credentials or other sensitive configuration details.
- Internal network services that are typically not exposed to the public internet.
- Any other host or service that the compromised n8n-mcp server has network access to.
The primary risk is for multi-tenant HTTP installations, where multiple operators might have valid authentication tokens, or where a token is shared with less-trusted clients. Single-tenant deployments using standard input/output (stdio) or HTTP deployments without multi-tenant headers are not affected by this specific exploit.
Possible Solutions
The most effective solution is to update your n8n-mcp installation immediately. The vulnerability is fixed in version 2.47.4. Upgrading to this version or any later release will patch the vulnerability and protect your system from exploitation.
For those unable to update immediately, considering your deployment configuration can offer some insight into immediate risk. If your n8n-mcp instance operates in a single-tenant stdio deployment or an HTTP deployment without multi-tenant headers, you are not directly affected by this specific vulnerability. However, upgrading remains the best practice for overall security posture.
References
https://github.com/czlonkowski/n8n-mcp/commit/d9d847f230923d96e0857ccecf3a4dedcc9b0096
https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.4
https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-4ggg-h7ph-26qr
