Executive brief
n8n-mcp is a Node.js integration tool that connects n8n workflow automation with Model Context Protocol clients. Versions before 2.50.1 contain three distinct security flaws: unauthenticated path traversal allowing access to unintended API endpoints, redirect-following SSRF attacks against configured webhook and form URLs, and unredacted telemetry data containing sensitive credentials like API keys and webhook secrets. Exploitation requires authentication to the MCP interface and could expose sensitive workflow data or allow lateral movement within connected services.
Technical details
The vulnerability consists of three independently reported issues: (1) Path traversal via unvalidated workflow identifiers used as URL path segments in the n8n API client, allowing authenticated callers to bypass access controls by crafting malicious workflow IDs; (2) SSRF through redirect-following in webhook, form, and chat trigger URL validation, where URLs passing initial validation can redirect to otherwise-rejected hosts with response bodies returned to the caller; (3) Information disclosure through telemetry mutation tracking that stores unredacted operation payloads containing node parameters such as bearer tokens, API keys, and webhook secrets. All three issues require an authenticated MCP caller and an n8n API integration configured with an API key. The fix is available in n8n-mcp version 2.50.1 and later.
Affected products
- n8n n8n-mcp < 2.50.1
Timeline
- 2026-05-08: disclosed
- 2026-05-08: patched: Patched in version 2.50.1