GHSA-qrx8-25qr-5r7v: n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

Summary

When @n8n/mcp-browser runs in HTTP transport mode (--transport http), its MCP endpoint accepts session initialization and tool calls with no authentication. Any network-reachable client, or any website the user visits, can open an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is active, the attacker gets navigation, JavaScript evaluation, and cookie and storage access against the user's real browser profile. The default stdio transport is not affected.

Mitigation

The issue has been fixed in n8n versions 2.25.7 and 2.26.2; upgrade to one of these or later. Temporary workarounds: avoid HTTP transport and use the default stdio transport instead, or if HTTP is required, restrict network access to the listening port to trusted clients using host-based firewall rules. The source states these workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmDeclares an LLM dependency

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
• MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database
• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database