{"id":"GHSA-8g7g-hmwm-6rv2","aliases":[],"status":"published","title":"n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure","description":"## Impact\n\n`n8n-mcp` versions before 2.50.1 contained three independently-reported issues affecting deployments that run the n8n API integration:\n\n1. **Caller-supplied identifiers were not validated before being used as URL path segments** by the n8n API client. An authenticated MCP caller passing a crafted workflow id could cause outbound requests carrying the configured n8n API key to land on other same-origin endpoints, bypassing handler-level access controls (including `DISABLED_TOOLS`).\n\n2. **Validated webhook, form, and chat trigger URLs followed redirects.** A URL that passed initial validation could redirect the outbound request to a host that would otherwise have been rejected, with the response body returned to the caller. Reachable as non-blind SSRF over authenticated MCP calls.\n\n3. **Mutation telemetry stored unredacted operation payloads.** On instances running with the default opt-in telemetry, partial-update operation diffs were uploaded without redaction. Operation values can carry the same node-parameter values the workflow contains, including bearer tokens, API keys, and webhook secrets.\n\n## Severity\n\nCVSS 8.3 (HIGH). Exploitation requires an authenticated MCP caller and an n8n API integration configured with an n8n API key.\n\n## Patched versions\n\nUpgrade to `n8n-mcp \u003e= 2.50.1`.\n\n## Workarounds\n\n- For issues (1) and (2): restrict network access to the HTTP transport (firewall, reverse-proxy ACL, or VPN) so only trusted callers can reach the MCP HTTP port; or switch to stdio mode, which exposes no HTTP surface for these issues.\n- For issue (3): set `N8N_MCP_TELEMETRY_DISABLED=true` in the environment before starting the server, or run `npx n8n-mcp telemetry disable` once.\n\n## Credit\n\nReported by @cybercraftsolutionsllc.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-22","CWE-918"],"published":"2026-05-08T17:00:09Z","modified":"2026-05-08T17:18:53Z","fixes":[{"ecosystem":"npm","package":"n8n-mcp","fixed_in":["2.50.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"n8n-mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.1"}]}]},{"source":"osv","ecosystem":"npm","package":"n8n-mcp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.50.1"}]}]}],"references":[{"url":"https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-8g7g-hmwm-6rv2","tags":["web"]},{"url":"https://github.com/czlonkowski/n8n-mcp/commit/1cfe9c6bddb4b1634e6e23323c18ea35fd196999","tags":["web"]},{"url":"https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.50.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8g7g-hmwm-6rv2"},{"url":"https://github.com/czlonkowski/n8n-mcp","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-8g7g-hmwm-6rv2","title":"n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure","description":"## Impact\n\n`n8n-mcp` versions before 2.50.1 contained three independently-reported issues affecting deployments that run the n8n API integration:\n\n1. **Caller-supplied identifiers were not validated before being used as URL path segments** by the n8n API client. An authenticated MCP caller passing a crafted workflow id could cause outbound requests carrying the configured n8n API key to land on other same-origin endpoints, bypassing handler-level access controls (including `DISABLED_TOOLS`).\n\n2. **Validated webhook, form, and chat trigger URLs followed redirects.** A URL that passed initial validation could redirect the outbound request to a host that would otherwise have been rejected, with the response body returned to the caller. Reachable as non-blind SSRF over authenticated MCP calls.\n\n3. **Mutation telemetry stored unredacted operation payloads.** On instances running with the default opt-in telemetry, partial-update operation diffs were uploaded without redaction. Operation values can carry the same node-parameter values the workflow contains, including bearer tokens, API keys, and webhook secrets.\n\n## Severity\n\nCVSS 8.3 (HIGH). Exploitation requires an authenticated MCP caller and an n8n API integration configured with an n8n API key.\n\n## Patched versions\n\nUpgrade to `n8n-mcp \u003e= 2.50.1`.\n\n## Workarounds\n\n- For issues (1) and (2): restrict network access to the HTTP transport (firewall, reverse-proxy ACL, or VPN) so only trusted callers can reach the MCP HTTP port; or switch to stdio mode, which exposes no HTTP surface for these issues.\n- For issue (3): set `N8N_MCP_TELEMETRY_DISABLED=true` in the environment before starting the server, or run `npx n8n-mcp telemetry disable` once.\n\n## Credit\n\nReported by @cybercraftsolutionsllc.","status":"published","published":"2026-05-08T17:00:09Z","modified":"2026-05-08T17:00:11Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-22","CWE-200","CWE-918"],"updated_at":"2026-11-02T14:40:04.762828Z"}],"osv":[{"id":"GHSA-8g7g-hmwm-6rv2","title":"n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure","description":"## Impact\n\n`n8n-mcp` versions before 2.50.1 contained three independently-reported issues affecting deployments that run the n8n API integration:\n\n1. **Caller-supplied identifiers were not validated before being used as URL path segments** by the n8n API client. An authenticated MCP caller passing a crafted workflow id could cause outbound requests carrying the configured n8n API key to land on other same-origin endpoints, bypassing handler-level access controls (including `DISABLED_TOOLS`).\n\n2. **Validated webhook, form, and chat trigger URLs followed redirects.** A URL that passed initial validation could redirect the outbound request to a host that would otherwise have been rejected, with the response body returned to the caller. Reachable as non-blind SSRF over authenticated MCP calls.\n\n3. **Mutation telemetry stored unredacted operation payloads.** On instances running with the default opt-in telemetry, partial-update operation diffs were uploaded without redaction. Operation values can carry the same node-parameter values the workflow contains, including bearer tokens, API keys, and webhook secrets.\n\n## Severity\n\nCVSS 8.3 (HIGH). Exploitation requires an authenticated MCP caller and an n8n API integration configured with an n8n API key.\n\n## Patched versions\n\nUpgrade to `n8n-mcp \u003e= 2.50.1`.\n\n## Workarounds\n\n- For issues (1) and (2): restrict network access to the HTTP transport (firewall, reverse-proxy ACL, or VPN) so only trusted callers can reach the MCP HTTP port; or switch to stdio mode, which exposes no HTTP surface for these issues.\n- For issue (3): set `N8N_MCP_TELEMETRY_DISABLED=true` in the environment before starting the server, or run `npx n8n-mcp telemetry disable` once.\n\n## Credit\n\nReported by @cybercraftsolutionsllc.","status":"published","published":"2026-05-08T17:00:09Z","modified":"2026-05-08T17:18:53.178111Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-200","CWE-22","CWE-918"],"updated_at":"2026-11-02T15:46:42.437513Z"}]}}