PT-2026-50175 · Unknown+1 · @N8N/Mcp-Browser+1

Espanda666 · CVE-2026-54309 · Published 2026-06-16 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.25.7 n8n versions prior to 2.26.2

Description When @n8n/mcp-browser is operated in HTTP transport mode using the --transport http flag, the MCP endpoint allows session initialization and tool invocation requests without authentication. This enables any network-reachable client or website visited by the user to establish a session and utilize browser-control tools. If the n8n AI Browser Bridge extension is installed and a connection is active, an unauthenticated caller can perform actions such as navigation, JavaScript evaluation, and access cookies and storage within the user's actual browser profile.

Recommendations Update to version 2.25.7 or later. Update to version 2.26.2 or later. Avoid running @n8n/mcp-browser with the HTTP transport and use the default stdio transport instead. Restrict network access to the listening port to trusted clients only using host-based firewall rules if HTTP transport is required.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-54309

GHSA-QRX8-25QR-5R7V

Affected Products

@N8N/Mcp-Browser

N8N

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54309.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-qrx8-25qr-5r7v · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-54309 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-54309 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qrx8-25qr-5r7v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54309 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://t.me/cveNotify/175931 · Telegram Post
• https://t.me/cveNotify/173305 · Telegram Post