Executive brief
n8n-mcp is a tool used to facilitate communication between n8n automation workflows and Model Context Protocol (MCP) servers. A security flaw in its HTTP transport layer allows unauthenticated users to terminate active sessions and view sensitive operational metadata. This could lead to service disruptions and provide attackers with information needed to launch further attacks against the infrastructure.
Technical details
The n8n-mcp package fails to perform proper authentication (CWE-306) on several HTTP transport endpoints. Specifically, the health check endpoint exposes sensitive operational metadata without credentials, and session management endpoints allow unauthenticated users to terminate active MCP sessions. An attacker with network access to the HTTP server can exploit these flaws without any prior privileges or user interaction. The vulnerability is addressed in version 2.47.6 by requiring Bearer authentication for all session endpoints and minimizing the health check response to a simple liveness check. Users can also mitigate the risk by switching to 'stdio' mode, which disables the HTTP transport entirely.
Affected products
- czlonkowski n8n-mcp <= 2.47.5
Timeline
- 2026-04-10: disclosed
- 2026-04-10: patched: Fixed in version 2.47.6
- 2026-04-10: advisory
References
- https://api.github.com/users/yotampe-pluto
- https://github.com/yotampe-pluto
- https://api.github.com/users/yotampe-pluto/gists%7B/gist_id%7D
- https://api.github.com/users/yotampe-pluto/repos
- https://avatars.githubusercontent.com/u/252890338?v=4
- https://api.github.com/users/yotampe-pluto/events%7B/privacy%7D