Which versions of n8n are affected by EUVD-2026-38468?

n8n's MCP Browser Bridge package (versions <2.25.7 and 2.26.0-2.26.1) contains an unauthenticated browser hijacking vulnerability (CVSS 8.8) that allows remote attackers to seize control of victim…. A patch is available.

How to fix or mitigate EUVD-2026-38468?

Within 24 hours: Identify all n8n deployments running @n8n/mcp-browser and verify which have HTTP transport enabled; audit active instances. Within 7 days: Upgrade @n8n/mcp-browser to version 2.25.7 (stable branch) or 2.26.2 or later (2.26.x branch) across all affected instances; as interim mitigation, disable HTTP transport for MCP endpoints and restrict network access to internal networks only. Within 30 days: Verify patch deployment complete; audit MCP browser API logs for unauthorized calls or session anomalies; review threat intelligence for exploitation indicators.

n8n EUVD-2026-38468

Q: What is the CVSS score of EUVD-2026-38468?

EUVD-2026-38468 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

Q: How to fix or mitigate EUVD-2026-38468?

Within 24 hours: Identify all n8n deployments running @n8n/mcp-browser and verify which have HTTP transport enabled; audit active instances. Within 7 days: Upgrade @n8n/mcp-browser to version 2.25.7 (stable branch) or 2.26.2 or later (2.26.x branch) across all affected instances; as interim mitigation, disable HTTP transport for MCP endpoints and restrict network access to internal networks only. Within 30 days: Verify patch deployment complete; audit MCP browser API logs for unauthorized calls or session anomalies; review threat intelligence for exploitation indicators.

| CVE-2026-54309 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 https://github.com/n8n-io/n8n

GHSA-qrx8-25qr-5r7v

Authentication Bypass

8.8

CVSS 4.0 · Vendor: https://github.com/n8n-io/n8n

Severity by source

Vendor (https://github.com/n8n-io/n8n) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Network-reachable endpoint with no auth (PR:N, UI:N); driving a live browser yields high confidentiality and integrity impact, low availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/n8n-io/n8n).

CVSS VectorVendor: https://github.com/n8n-io/n8n

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 17:14 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 17:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 17:07 vuln.today

cvss_changed

CVSS changed

Jun 23, 2026 - 17:07 NVD

10.0 (HIGH) 8.8 (HIGH)

Source Code Evidence Fetched

Jun 17, 2026 - 00:14 vuln.today

Analysis Generated

Jun 17, 2026 - 00:14 vuln.today

DescriptionCVE.org

Impact

When @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools.

Where the n8n AI Browser Bridge extension is installed and a browser connection is active, an unauthenticated caller can access browser-control capabilities including navigation, JavaScript evaluation, and cookie and storage access against the user's real browser profile.

This issue only affects instances where @n8n/mcp-browser is run with the HTTP transport (--transport http). The default transport is stdio, which is not affected.

Patches

The issue has been fixed in n8n versions 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Avoid running @n8n/mcp-browser with the HTTP transport; use the default stdio transport instead.
If HTTP transport is required, restrict network access to the listening port to trusted clients only using host-based firewall rules.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

AnalysisAI

Unauthenticated browser hijacking in n8n's @n8n/mcp-browser package (versions <2.25.7 and 2.26.0-2.26.1) allows any network-reachable attacker or malicious website to invoke browser-control tools against a victim's real browser profile when HTTP transport is enabled. No public exploit identified at time of analysis, but the missing-authentication flaw (CWE-306) requires only that the operator started the MCP endpoint with --transport http and has the n8n AI Browser Bridge extension active.

Technical ContextAI

n8n is a popular open-source workflow automation platform, and @n8n/mcp-browser is its Model Context Protocol (MCP) server that exposes browser-control primitives - navigation, JavaScript evaluation, cookie and storage access - to AI agents via an MCP session. The root cause is CWE-306 (Missing Authentication for a Critical Function): when launched with --transport http, the HTTP MCP endpoint accepts session initialization and tool invocations from any caller without verifying identity or origin. Because the bridge drives the user's real browser profile through the AI Browser Bridge extension, any process that can reach the listening port - including JavaScript running in any tab the user visits, since browsers can issue cross-origin POSTs to localhost - can drive that browser. The default stdio transport is unaffected because it is bound to a parent process pipe rather than a network socket.

RemediationAI

Vendor-released patch: upgrade n8n to 2.25.7 (for the 2.25.x line) or 2.26.2 (for the 2.26.x line) or later, per GHSA-qrx8-25qr-5r7v (https://github.com/n8n-io/n8n/security/advisories/GHSA-qrx8-25qr-5r7v). If immediate upgrade is not possible, switch @n8n/mcp-browser back to the default stdio transport by removing the --transport http flag, which eliminates the network-exposed endpoint entirely at the cost of forcing local-only MCP clients. If HTTP transport must remain, restrict the listening port with host-based firewall rules to trusted clients only, and bind to loopback while adding browser-side protections against DNS rebinding; note that loopback alone does not defend against malicious JavaScript in a visited tab, so this is partial mitigation only.