{"data":{"id":"170b58de-146a-402a-b9a6-24fd9bf227a4","title":"GHSA-56c3-vfp2-5qqj: n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders","summary":"GHSA-56c3-vfp2-5qqj affects n8n-mcp deployments embedding the SDK via N8NDocumentationMCPServer or N8NMCPEngine with user-supplied InstanceContext, on versions v2.47.4 through v2.47.13. The synchronous validator SSRFProtection.validateUrlSync() had no IPv6 checks, so IPv4-mapped IPv6 addresses such as http://[::ffff:169.254.169.254] bypassed cloud-metadata, localhost and private-IP checks. An attacker who controls n8nApiUrl can receive response bodies from internal targets, and the n8nApiKey is forwarded in the x-n8n-api-key header to the attacker-controlled host.","solution":"Fixed in v2.47.14. Upgrade with `npx n8n-mcp@latest` (or pin to `>= 2.47.14`), or `docker pull ghcr.io/czlonkowski/n8n-mcp:latest`. Workarounds if upgrading is not immediate: reject n8nApiUrl values whose hostname is an IP literal (bracketed IPv6 or dotted IPv4) before calling the SDK; restrict egress from the process to RFC1918 ranges, 169.254.0.0/16 and cloud metadata endpoints; and do not accept user-controlled n8nApiUrl values.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-56c3-vfp2-5qqj","publishedAt":"2026-04-30T18:12:54.000Z","cveId":"CVE-2026-42449","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n-mcp@>= 2.47.4, < 2.47.14 (fixed: 2.47.14)"],"affectedPackageNames":["n8n-mcp"],"affectedPackageRefs":["npm:n8n-mcp"],"affectedVendors":[],"affectedVendorsRaw":["n8n-mcp","n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00206,"epssCheckedAt":"2026-11-10T00:11:23.778Z","kevDateAdded":null,"advisoryAliases":["GHSA-56c3-vfp2-5qqj"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-30T18:12:54.000Z","fixReleasedAt":"2026-04-21T16:57:50.848Z","daysToFix":-9,"fixCheckedAt":"2026-10-29T21:37:04.966Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n-mcp","fixedVersion":"2.47.14","matchedVersion":"2.47.14","fixReleasedAt":"2026-04-21T16:57:50.848Z","daysToFix":-9,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:37:04.820Z"}]}}