EUVD-2026-20968
GHSA-4ggg-h7ph-26qr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid AUTH_TOKEN
-
DeliveryCraft HTTP request with malicious URL in multi-tenant header
-
ExploitServer issues request to arbitrary URL
-
ExecutionResponse body reflected in JSON-RPC
-
ImpactExtract sensitive data from metadata endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker requires valid AUTH_TOKEN for n8n-mcp server. Exploits multi-tenant HTTP installations where attackers can manipulate HTTP headers to trigger arbitrary HTTP requests. Server response bodies reflected in JSON-RPC responses, enabling metadata endpoint and internal network service reconnaissance. |
| Impact | CVSS 8.5 reflects high confidentiality impact through metadata endpoint exfiltration and internal service reconnaissance. Risk is confined to multi-tenant HTTP deployments where multiple authenticated users hold valid AUTH_TOKENs. Single-tenant stdio installations are unaffected. Patch availability and straightforward egress filtering mitigation reduce organizational blast radius significantly. Priority depends on deployment topology and token distribution practices. |
| Exploit ScenarioDerived | Authenticated attacker with valid AUTH_TOKEN submits HTTP request with manipulated |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Server-Side Request Forgery in n8n-mcp (npm package) versions ≤2.47.3 allows authenticated attackers with valid AUTH_TOKEN to force the server to issue HTTP requests to arbitrary URLs via manipulated multi-tenant HTTP headers (x-n8n-url, x-n8n-key). Response bodies are reflected through JSON-RPC, enabling unauthorized access to cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Oracle, Alibaba), internal network services, and any host reachable by the server process. Multi-tenant HTTP deployments with shared or multiple AUTH_TOKENs are at highest risk. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to n8n-mcp version 2.47.4 or later; no configuration changes required. If immediate upgrade is not feasible, implement network-layer egress filtering to block outbound traffic to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local 169.254.0.0/16, and cloud metadata endpoints. Disable ENABLE_MULTI_TENANT flag and reject x-n8n-url/x-n8n-key headers at reverse proxy if multi-tenant functionality is unnecessary. Restrict AUTH_TOKEN distribution to fully trusted operators only. Official advisory and patch details: https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-4ggg-h7ph-26qr and commit https://github.com/czlonkowski/n8n-mcp/commit/d9d847f230923d96e0857ccecf3a4dedcc9b0096
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-918 SSRF arises from insufficient validation of user-controlled URLs passed through multi-tenant HTTP headers before server-issued requests. The vulnerability permits URL reflection in JSON-RPC responses, enabling metadata exfiltration. Patch 2.47.4 implements URL entry-point validation and client-layer normalization. Single-tenant stdio deployments remain unaffected.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Primary rating from Vendor (https://github.com/czlonkowski/n8n-mcp) · only source for this CVE.
CVSS VectorVendor: https://github.com/czlonkowski/n8n-mcp
Lifecycle Timeline
2DescriptionCVE.org
Impact
An authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTH_TOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the contents of any URL the server can reach - including cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and any other host the server process has network access to.
The primary at-risk deployments are multi-tenant HTTP installations where more than one operator can present a valid AUTH_TOKEN, or where a token is shared with less-trusted clients. Single-tenant stdio deployments and HTTP deployments without multi-tenant headers are not affected.
Affected versions
n8n-mcp ≤ 2.47.3 (all versions up to and including 2.47.3).
Patched versions
n8n-mcp 2.47.4 and later.
Workarounds
If you cannot immediately upgrade:
- Egress filtering at the network layer - block outbound traffic from the
n8n-mcpcontainer to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local169.254.0.0/16, and any other internal ranges. This defends against any future SSRF-class issue and is recommended even after upgrading. - Disable multi-tenant headers - if your deployment does not require per-request instance switching, unset
ENABLE_MULTI_TENANTand do not acceptx-n8n-url/x-n8n-keyheaders at the reverse proxy. - Restrict
AUTH_TOKENdistribution - ensure the bearer token is only held by fully trusted operators until you can upgrade.
Remediation
Upgrade to n8n-mcp 2.47.4 or later. No configuration changes are required; the fix adds validation at the URL entry points and normalizes URLs at the API client layer.
Credits
Reported by the Eresus Security Research Team. @ibrahmsql
Executive ViewAI
CVE-2026-39974 is a server-side request forgery vulnerability in n8n-mcp (npm package) versions 2.47.3 and earlier that allows authenticated users to manipulate HTTP headers and force the server to access cloud metadata endpoints and internal network services. Organizations using n8n-mcp in multi-tenant deployments face elevated risk of unauthorized access to sensitive credentials and internal infrastructure.
Apply vendor patch. If immediate patching is not possible: (1) Implement firewall rules blocking server egress to 169.254.169.254 (AWS IMDS), 0.0.0.0/0 metadata endpoints, and internal network ranges; (2) enforce strict validation of x-n8n-url and x-n8n-key headers at network ingress; (3) restrict AUTH_TOKEN distribution to minimal required personnel; (4) enable request/response logging for all n8n-mcp traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB