CVE-2026-42449: czlonkowski n8n-mcp SSRF via IPv4-mapped IPv6 addresses

CVE-2026-42449 · Severity: high · CVSS 8.5 · Published 2026-05-07

n8n-mcp is a Model Context Protocol server for building n8n workflows. The SDK embedder path contains a URL validation function that failed to check IPv6 address formats, allowing attackers to bypass SSRF protections using IPv6-mapped addresses like `::ffff:169.254.169.254`. This enables unauthorized access to cloud metadata endpoints (AWS IMDS, GCP, Azure), private networks, and localhost services, with API credentials forwarded to the attacker.

Technologies: n8n-mcp (npm). Vendors: npm.

Quick answers

Is CVE-2026-42449 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42449 being exploited in the wild.
How severe is CVE-2026-42449?
High severity, with a CVSS score of 8.5, published 7 May 2026.
Which products and versions are affected?
n8n-mcp (npm) >= 2.47.4, < 2.47.14, SEMVER:introduced=2.47.4,fixed=2.47.14.
Is there a fix for CVE-2026-42449?
Yes. n8n-mcp (npm): upgrade to 2.47.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42449 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42449?
Check whether you run n8n-mcp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • n8n-mcp (npm): upgrade to 2.47.14 or later
    npm install n8n-mcp@2.47.14

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) bypass in the `SSRFProtection.validateUrlSync()` function, which is used for synchronous URL validation in the SDK embedder code path (N8NDocumentationMCPServer constructor, getN8nApiClient(), and validateInstanceContext()). The validator implements checks for cloud-metadata endpoints, localhost, and private IPv4 ranges, but lacks IPv6 validation logic. Attackers can bypass these checks by supplying IPv4-mapped IPv6 addresses (e.g., `http://[::ffff:169.254.169.254]` or `http://[::ffff:127.0.0.1]`) or other special IPv6 ranges (IPv4-compatible, 6to4, NAT64, ULA, site-local). When a user-controlled `n8nApiUrl` is passed to the SDK, the validator fails to reject these crafted addresses. This enables non-blind SSRF attacks where response bodies are returned to the caller, and the `x-n8n-api-key` header is forwarded to the attacker-controlled target. The async webhook validator (`validateWebhookUrl`) was not affected as it already performed IPv6 checks. The vulnerability affects v2.47.4 through v2.47.13 and is patched in v2.47.14.

Affected products

  • n8n n8n-mcp 2.47.4 through 2.47.13

Identifiers

  • CVE-2026-42449
  • GHSA-56c3-vfp2-5qqj

Timeline

  • 2026-04-30: disclosed: Vulnerability published on GitHub Security Advisory
  • 2026-04-21: patched: Fixed in version 2.47.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.