GHSA-56c3-vfp2-5qqj: n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

Summary

GHSA-56c3-vfp2-5qqj affects n8n-mcp deployments embedding the SDK via N8NDocumentationMCPServer or N8NMCPEngine with user-supplied InstanceContext, on versions v2.47.4 through v2.47.13. The synchronous validator SSRFProtection.validateUrlSync() had no IPv6 checks, so IPv4-mapped IPv6 addresses such as http://[::ffff:169.254.169.254] bypassed cloud-metadata, localhost and private-IP checks. An attacker who controls n8nApiUrl can receive response bodies from internal targets, and the n8nApiKey is forwarded in the x-n8n-api-key header to the attacker-controlled host.

Mitigation

Fixed in v2.47.14. Upgrade with `npx n8n-mcp@latest` (or pin to `>= 2.47.14`), or `docker pull ghcr.io/czlonkowski/n8n-mcp:latest`. Workarounds if upgrading is not immediate: reject n8nApiUrl values whose hostname is an IP literal (bracketed IPv6 or dotted IPv4) before calling the SDK; restrict egress from the process to RFC1918 ranges, 169.254.0.0/16 and cloud metadata endpoints; and do not accept user-controlled n8nApiUrl values.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News