Executive brief
n8n-mcp is a Model Context Protocol server for building n8n workflows. The SDK embedder path contains a URL validation function that failed to check IPv6 address formats, allowing attackers to bypass SSRF protections using IPv6-mapped addresses like `::ffff:169.254.169.254`. This enables unauthorized access to cloud metadata endpoints (AWS IMDS, GCP, Azure), private networks, and localhost services, with API credentials forwarded to the attacker.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) bypass in the `SSRFProtection.validateUrlSync()` function, which is used for synchronous URL validation in the SDK embedder code path (N8NDocumentationMCPServer constructor, getN8nApiClient(), and validateInstanceContext()). The validator implements checks for cloud-metadata endpoints, localhost, and private IPv4 ranges, but lacks IPv6 validation logic. Attackers can bypass these checks by supplying IPv4-mapped IPv6 addresses (e.g., `http://[::ffff:169.254.169.254]` or `http://[::ffff:127.0.0.1]`) or other special IPv6 ranges (IPv4-compatible, 6to4, NAT64, ULA, site-local). When a user-controlled `n8nApiUrl` is passed to the SDK, the validator fails to reject these crafted addresses. This enables non-blind SSRF attacks where response bodies are returned to the caller, and the `x-n8n-api-key` header is forwarded to the attacker-controlled target. The async webhook validator (`validateWebhookUrl`) was not affected as it already performed IPv6 checks. The vulnerability affects v2.47.4 through v2.47.13 and is patched in v2.47.14.
Affected products
- n8n n8n-mcp 2.47.4 through 2.47.13
Timeline
- 2026-04-30: disclosed: Vulnerability published on GitHub Security Advisory
- 2026-04-21: patched: Fixed in version 2.47.14