czlonkowski n8n-mcp up to 2.47.3 Model Context Protocol server-side request forgery

Summaryinfo

A vulnerability classified as critical has been found in czlonkowski n8n-mcp up to 2.47.3. Affected by this issue is some unknown functionality of the component Model Context Protocol. The manipulation leads to server-side request forgery. This vulnerability is documented as CVE-2026-39974. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in czlonkowski n8n-mcp up to 2.47.3 and classified as critical. This issue affects some unknown processing of the component Model Context Protocol. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTH_TOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the contents of any URL the server can reach — including cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and any other host the server process has network access to. The primary at-risk deployments are multi-tenant HTTP installations where more than one operator can present a valid AUTH_TOKEN, or where a token is shared with less-trusted clients. Single-tenant stdio deployments and HTTP deployments without multi-tenant headers are not affected. This vulnerability is fixed in 2.47.4.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-39974 since 04/08/2026. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.47.4 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch d9d847f230923d96e0857ccecf3a4dedcc9b0096 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• czlonkowski

Name

• n8n-mcp

Version

• 2.47.0
• 2.47.1
• 2.47.2
• 2.47.3

License

• open-source

Website

• Product: https://github.com/czlonkowski/n8n-mcp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion