Executive brief
n8n-mcp is a Model Context Protocol server that enables Claude to build and manage n8n workflows. An authenticated attacker with a valid bearer token can exploit a server-side request forgery vulnerability to make the server fetch arbitrary URLs—including cloud metadata endpoints, internal services, and other hosts on the network. In multi-tenant HTTP deployments where multiple operators share authentication tokens, this could expose sensitive configuration data and enable further attacks.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in n8n-mcp's multi-tenant HTTP mode, where user-supplied URLs via the x-n8n-url and x-n8n-key headers are not sufficiently validated before being used in outbound HTTP requests. An attacker holding a valid AUTH_TOKEN can inject arbitrary URLs, causing the server to fetch and return response bodies through the JSON-RPC interface. This allows reading cloud instance metadata (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and any other endpoint reachable from the server process. The vulnerability requires an authenticated caller and is specific to multi-tenant HTTP deployments; single-tenant stdio deployments and HTTP mode without multi-tenant headers are unaffected. The fix, released in version 2.47.4, adds URL validation at entry points and normalizes URLs at the API client layer.
Affected products
- czlonkowski n8n-mcp <=2.47.3
Timeline
- 2026-04-08: disclosed: Vulnerability disclosed via GHSA-4ggg-h7ph-26qr
- 2026-04-08: patched: Fix released in n8n-mcp v2.47.4