PT-2026-41699 — SSRF em Npm N8N-Mcp

PT-2026-41699 · Npm · N8N-Mcp

Publicado

2026-05-08

Atualizado

2026-05-08

CVSS v3.1

8.3

Alta

Vetor

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

n8n-mcp versions before 2.50.1 contained three independently-reported issues affecting deployments that run the n8n API integration:

Caller-supplied identifiers were not validated before being used as URL path segments by the n8n API client. An authenticated MCP caller passing a crafted workflow id could cause outbound requests carrying the configured n8n API key to land on other same-origin endpoints, bypassing handler-level access controls (including DISABLED TOOLS).
Validated webhook, form, and chat trigger URLs followed redirects. A URL that passed initial validation could redirect the outbound request to a host that would otherwise have been rejected, with the response body returned to the caller. Reachable as non-blind SSRF over authenticated MCP calls.
Mutation telemetry stored unredacted operation payloads. On instances running with the default opt-in telemetry, partial-update operation diffs were uploaded without redaction. Operation values can carry the same node-parameter values the workflow contains, including bearer tokens, API keys, and webhook secrets.

CVSS 8.3 (HIGH). Exploitation requires an authenticated MCP caller and an n8n API integration configured with an n8n API key.

Upgrade to n8n-mcp >= 2.50.1.

For issues (1) and (2): restrict network access to the HTTP transport (firewall, reverse-proxy ACL, or VPN) so only trusted callers can reach the MCP HTTP port; or switch to stdio mode, which exposes no HTTP surface for these issues.
For issue (3): set N8N MCP TELEMETRY DISABLED=true in the environment before starting the server, or run npx n8n-mcp telemetry disable once.

Reported by @cybercraftsolutionsllc.

Correção

SSRF

Path traversal

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

GHSA-8G7G-HMWM-6RV2

N8N-Mcp