GHSA-cmrh-wvq6-wm9r: n8n-mcp webhook and API client paths has an authenticated SSRF

Summary

Authenticated server-side request forgery in n8n-mcp affects the webhook trigger tools, the n8n API client via N8N_API_URL, and per-request URLs supplied in the x-n8n-url header in multi-tenant HTTP mode. A caller with an MCP session can make the n8n-mcp host send requests to internal services and cloud metadata endpoints, and the response body is returned to the caller. Fixed in n8n-mcp@2.50.2.

Mitigation

Fixed in `n8n-mcp@2.50.2`. Operators whose N8N_API_URL points at localhost or a private address should set WEBHOOK_SECURITY_MODE to moderate (allows localhost, still blocks RFC1918 and cloud metadata) or permissive (also allows RFC1918, only safe on a trusted private network); the default strict applies where n8n is on a public hostname. Workarounds for deployments that cannot upgrade: restrict network egress from the host and deny cloud metadata IPs (169.254.169.254, 169.254.170.2, 100.100.100.200, 192.0.0.192, and the GCP metadata.google.internal resolved IP) and RFC1918 networks; run in stdio mode instead of HTTP; or set DISABLED_TOOLS=n8n_trigger_webhook_workflow,n8n_create_workflow,n8n_test_workflow.

Topics

• Model Context Protocol

Related items

• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• HighGHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU AttacksSimilar attack · GitHub Advisory Database
• MediumGHSA-5m6c-38r8-5w76: Dagu MCP DAG specification read bypasses path containment and workspace isolationSimilar attack · GitHub Advisory Database
• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database