GHSA-8g7g-hmwm-6rv2
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
GHSA-8g7g-hmwm-6rv2 is a high vulnerability (CVSS 8.3) in n8n-mcp, published May 8, 2026. No source lists public exploit code. Fixed in n8n-mcp 2.50.1.
- Severity
- 8.3 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.50.1n8n-mcp
Description
Impact
n8n-mcp versions before 2.50.1 contained three independently-reported issues affecting deployments that run the n8n API integration:
Caller-supplied identifiers were not validated before being used as URL path segments by the n8n API client. An authenticated MCP caller passing a crafted workflow id could cause outbound requests carrying the configured n8n API key to land on other same-origin endpoints, bypassing handler-level access controls (including
DISABLED_TOOLS).Validated webhook, form, and chat trigger URLs followed redirects. A URL that passed initial validation could redirect the outbound request to a host that would otherwise have been rejected, with the response body returned to the caller. Reachable as non-blind SSRF over authenticated MCP calls.
Mutation telemetry stored unredacted operation payloads. On instances running with the default opt-in telemetry, partial-update operation diffs were uploaded without redaction. Operation values can carry the same node-parameter values the workflow contains, including bearer tokens, API keys, and webhook secrets.
Severity
CVSS 8.3 (HIGH). Exploitation requires an authenticated MCP caller and an n8n API integration configured with an n8n API key.
Patched versions
Upgrade to n8n-mcp >= 2.50.1.
Workarounds
- For issues (1) and (2): restrict network access to the HTTP transport (firewall, reverse-proxy ACL, or VPN) so only trusted callers can reach the MCP HTTP port; or switch to stdio mode, which exposes no HTTP surface for these issues.
- For issue (3): set
N8N_MCP_TELEMETRY_DISABLED=truein the environment before starting the server, or runnpx n8n-mcp telemetry disableonce.
Credit
Reported by @cybercraftsolutionsllc.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
n8n-mcpnpm | before 2.50.1 | 2.50.1 |
What each source reports
GitHub Advisories Score used
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
Impact
n8n-mcp versions before 2.50.1 contained three independently-reported issues affecting deployments that run the n8n API integration:
Caller-supplied identifiers were not validated before being used as URL path segments by the n8n API client. An authenticated MCP caller passing a crafted workflow id could cause outbound requests carrying the configured n8n API key to land on other same-origin endpoints, bypassing handler-level access controls (including
DISABLED_TOOLS).Validated webhook, form, and chat trigger URLs followed redirects. A URL that passed initial validation could redirect the outbound request to a host that would otherwise have been rejected, with the response body returned to the caller. Reachable as non-blind SSRF over authenticated MCP calls.
Mutation telemetry stored unredacted operation payloads. On instances running with the default opt-in telemetry, partial-update operation diffs were uploaded without redaction. Operation values can carry the same node-parameter values the workflow contains, including bearer tokens, API keys, and webhook secrets.
Severity
CVSS 8.3 (HIGH). Exploitation requires an authenticated MCP caller and an n8n API integration configured with an n8n API key.
Patched versions
Upgrade to n8n-mcp >= 2.50.1.
Workarounds
- For issues (1) and (2): restrict network access to the HTTP transport (firewall, reverse-proxy ACL, or VPN) so only trusted callers can reach the MCP HTTP port; or switch to stdio mode, which exposes no HTTP surface for these issues.
- For issue (3): set
N8N_MCP_TELEMETRY_DISABLED=truein the environment before starting the server, or runnpx n8n-mcp telemetry disableonce.
Credit
Reported by @cybercraftsolutionsllc.
- Record
GHSA-8g7g-hmwm-6rv2- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-22, CWE-200, CWE-918
- Updated
- 2026-11-02
OSV
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
Impact
n8n-mcp versions before 2.50.1 contained three independently-reported issues affecting deployments that run the n8n API integration:
Caller-supplied identifiers were not validated before being used as URL path segments by the n8n API client. An authenticated MCP caller passing a crafted workflow id could cause outbound requests carrying the configured n8n API key to land on other same-origin endpoints, bypassing handler-level access controls (including
DISABLED_TOOLS).Validated webhook, form, and chat trigger URLs followed redirects. A URL that passed initial validation could redirect the outbound request to a host that would otherwise have been rejected, with the response body returned to the caller. Reachable as non-blind SSRF over authenticated MCP calls.
Mutation telemetry stored unredacted operation payloads. On instances running with the default opt-in telemetry, partial-update operation diffs were uploaded without redaction. Operation values can carry the same node-parameter values the workflow contains, including bearer tokens, API keys, and webhook secrets.
Severity
CVSS 8.3 (HIGH). Exploitation requires an authenticated MCP caller and an n8n API integration configured with an n8n API key.
Patched versions
Upgrade to n8n-mcp >= 2.50.1.
Workarounds
- For issues (1) and (2): restrict network access to the HTTP transport (firewall, reverse-proxy ACL, or VPN) so only trusted callers can reach the MCP HTTP port; or switch to stdio mode, which exposes no HTTP surface for these issues.
- For issue (3): set
N8N_MCP_TELEMETRY_DISABLED=truein the environment before starting the server, or runnpx n8n-mcp telemetry disableonce.
Credit
Reported by @cybercraftsolutionsllc.
- Record
GHSA-8g7g-hmwm-6rv2- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-200, CWE-22, CWE-918
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.