n8n-mcp@2.45.1

n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol (MCP)

Affected versions of this package are vulnerable to Missing Authorization in the workflow version history process in multi-tenant HTTP deployments due to improper isolation of stored backups between tenants. An attacker can access and manipulate other tenants' workflow version snapshots, potentially exposing sensitive data such as credential references and authorization headers, by making authenticated requests as a different tenant.

Note: This is only exploitable if the deployment is configured in HTTP mode with multi-tenancy enabled (ENABLE_MULTI_TENANT=true).

Upgrade n8n-mcp to version 2.56.1 or higher.

n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol (MCP)

Affected versions of this package are vulnerable to Failing Open when handing multi-tenant HTTP requests (ENABLE_MULTI_TENANT=true) containing one or neither of the x-n8n-url and x-n8n-key headers. An operator can gain unauthorized access to workflows, executions, data-table contents, and credential metadata, and potentially escalate privileges to execute arbitrary code within the operator's environment because the absence of these headers falls back to associating the request with process-level credentials. This is only exploitable if the deployment is running in HTTP mode.

Upgrade n8n-mcp to version 2.51.2 or higher.

n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol (MCP)

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the telemetry sanitization process in event-validator.ts. An operator with access to the telemetry backend can access fragments of URL parameters, exposing confidential information such as customer or tenant identifiers, short secrets in query strings, or signed request parameters. Workflow execution data and credentials are not exposed.

Upgrade n8n-mcp to version 2.51.3 or higher.

n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol (MCP)

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the N8nApiClient, when handling webhook triggers, API client base URLs, and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. An attacker who can control tool calls can enumerate internal services and expose stored secrets. This is only exploitable if the attacker has a valid MCP session or can influence tool arguments in single-tenant or stdio deployments.

Note: The fix for this vulnerability introduces WEBHOOK_SECURITY_MODE, which must be explicitly changed from its default value of strict if an operator is connecting to localhost or an RFC1918 address.

Upgrade n8n-mcp to version 2.50.2 or higher.

n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol (MCP)

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via improper validation of caller-supplied identifiers and redirect handling in the API integration process. An attacker can access sensitive information, bypass access controls, and trigger outbound requests to unintended endpoints by supplying crafted workflow IDs or URLs, and may also cause unredacted operation payloads containing secrets to be stored and exposed through telemetry. This is only exploitable if the deployment is configured with an n8n API key and the attacker is an authenticated MCP caller.

Upgrade n8n-mcp to version 2.50.1 or higher.

n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol (MCP)

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the SSRFProtection.validateUrlSync function in the src/utils/ssrf-protection.ts component. An attacker can reach internal services and cloud metadata endpoints by supplying IPv6-literal URLs such as IPv4-mapped, IPv4-compatible, 6to4, NAT64, ULA, or site-local addresses that bypass the synchronous URL validation. This lets user-controlled InstanceContext values in the SDK embedder path reach the HTTP client, exposing the x-n8n-api-key and allowing requests to localhost, RFC1918 networks, and metadata services.

Workarounds

• Reject any n8nApiUrl whose hostname is an IP literal, including bracketed IPv6 and dotted IPv4, before passing it to N8NDocumentationMCPServer or getN8nApiClient(). This prevents attacker-supplied URLs from reaching internal services or cloud metadata endpoints.
• Do not accept user-controlled n8nApiUrl values; derive the URL only from internal configuration. This removes the SSRF entry point entirely for SDK embedder deployments.
• Restrict outbound network access from the n8n-mcp process to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local 169.254.0.0/16, and cloud metadata endpoints. This limits SSRF blast radius even if a malicious URL is supplied.

Upgrade n8n-mcp to version 2.47.14 or higher.

n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol (MCP)

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the request dispatcher and related logging. An attacker can obtain sensitive information, such as credentials or API keys, by accessing improperly redacted server logs.

Note: This is only exploitable if the application is running in HTTP transport mode and logs are accessible outside the trusted boundary.

Upgrade n8n-mcp to version 2.47.13 or higher.

n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol (MCP)

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the POST /mcp endpoint. An attacker can cause sensitive information such as bearer tokens, API keys, and request payloads to be written to server logs by sending unauthorized requests.

Note: This is only exploitable if the application is running in HTTP transport mode and logs are accessible outside the trusted boundary.

Upgrade n8n-mcp to version 2.47.11 or higher.

n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol (MCP)

Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to missing authentication in several HTTP transport endpoints and exposure of sensitive operational metadata in the health check endpoint. An attacker can terminate active sessions and obtain information useful for further attacks by sending unauthenticated requests to the affected endpoints.

Upgrade n8n-mcp to version 2.47.6 or higher.