Skip to content
AI Sec Watch
HighVulnerability

GHSA-8g7g-hmwm-6rv2: n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-8g7g-hmwm-6rv2
Published
Record updated
View JSON
Affected
  • n8n-mcp < 2.50.1
Fixed in
2.50.1
  • released May 4, 2026, 4 days before disclosure

Summary

n8n-mcp versions before 2.50.1 contain three independently reported issues in deployments that use the n8n API integration. An authenticated MCP caller can supply crafted identifiers that the n8n API client uses as URL path segments, sending the configured n8n API key to other same-origin endpoints and bypassing handler-level controls including DISABLED_TOOLS. Validated webhook, form and chat trigger URLs also follow redirects, returning the response body to the caller, and default opt-in telemetry uploads unredacted operation payloads that can contain bearer tokens, API keys and webhook secrets. CVSS 8.3 (HIGH); exploitation requires an authenticated MCP caller and a configured n8n API key.

Mitigation

Upgrade to n8n-mcp >= 2.50.1. Workarounds: for the first two issues, restrict network access to the HTTP transport (firewall, reverse-proxy ACL or VPN) or switch to stdio mode; for the telemetry issue, set N8N_MCP_TELEMETRY_DISABLED=true before starting the server or run `npx n8n-mcp telemetry disable` once.

Topics

Related items