{"id":"GHSA-75hx-xj24-mqrw","aliases":[],"status":"published","title":"n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport","description":"### Summary\n\nSeveral HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.\n\n### Impact\n\nAn unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.\n\n### Patches\n\nFixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it.\n- **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.\n\nUpgrading to v2.47.6 is still strongly recommended.\n\n### Credit\n\nReported by @yotampe-pluto.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2026-04-10T20:59:58Z","modified":"2026-04-10T21:21:11Z","fixes":[{"ecosystem":"npm","package":"n8n-mcp","fixed_in":["2.47.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"n8n-mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.47.5"},{"fixed":"2.47.6"}]}]},{"source":"osv","ecosystem":"npm","package":"n8n-mcp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.47.6"}]}]}],"references":[{"url":"https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-75hx-xj24-mqrw","tags":["web"]},{"url":"https://github.com/czlonkowski/n8n-mcp/commit/ca9d4b3df6419b8338983be98f7940400f78bde3","tags":["web"]},{"url":"https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-75hx-xj24-mqrw"},{"url":"https://github.com/czlonkowski/n8n-mcp","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-75hx-xj24-mqrw","title":"n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport","description":"### Summary\n\nSeveral HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.\n\n### Impact\n\nAn unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.\n\n### Patches\n\nFixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it.\n- **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.\n\nUpgrading to v2.47.6 is still strongly recommended.\n\n### Credit\n\nReported by @yotampe-pluto.","status":"published","published":"2026-04-10T20:59:58Z","modified":"2026-04-10T20:59:59Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:39:53.087746Z"}],"osv":[{"id":"GHSA-75hx-xj24-mqrw","title":"n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport","description":"### Summary\n\nSeveral HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.\n\n### Impact\n\nAn unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.\n\n### Patches\n\nFixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it.\n- **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.\n\nUpgrading to v2.47.6 is still strongly recommended.\n\n### Credit\n\nReported by @yotampe-pluto.","status":"published","published":"2026-04-10T20:59:58Z","modified":"2026-04-10T21:21:11.279622Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}