GHSA-4ggg-h7ph-26qr

Source

https://github.com/advisories/GHSA-4ggg-h7ph-26qr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-4ggg-h7ph-26qr/GHSA-4ggg-h7ph-26qr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4ggg-h7ph-26qr

Aliases

CVE-2026-39974

Published

2026-04-08T19:53:48Z

Modified

2026-04-09T19:16:17Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N CVSS Calculator

Summary

n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode

Details

Impact

An authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTH_TOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the contents of any URL the server can reach — including cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and any other host the server process has network access to.

The primary at-risk deployments are multi-tenant HTTP installations where more than one operator can present a valid AUTH_TOKEN, or where a token is shared with less-trusted clients. Single-tenant stdio deployments and HTTP deployments without multi-tenant headers are not affected.

Affected versions

n8n-mcp ≤ 2.47.3 (all versions up to and including 2.47.3).

Patched versions

n8n-mcp 2.47.4 and later.

Workarounds

If you cannot immediately upgrade:

Egress filtering at the network layer — block outbound traffic from the n8n-mcp container to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local 169.254.0.0/16, and any other internal ranges. This defends against any future SSRF-class issue and is recommended even after upgrading.
Disable multi-tenant headers — if your deployment does not require per-request instance switching, unset ENABLE_MULTI_TENANT and do not accept x-n8n-url / x-n8n-key headers at the reverse proxy.
Restrict AUTH_TOKEN distribution — ensure the bearer token is only held by fully trusted operators until you can upgrade.

Remediation

Upgrade to n8n-mcp 2.47.4 or later. No configuration changes are required; the fix adds validation at the URL entry points and normalizes URLs at the API client layer.

Credits

Reported by the Eresus Security Research Team. @ibrahmsql

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-08T19:53:48Z",
    "nvd_published_at":  "2026-04-09T17:16:30Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / n8n-mcp

Package

Name: n8n-mcp; View open source insights on deps.dev
Purl: pkg:npm/n8n-mcp

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.47.4

Database specific

last_known_affected_version_range

"<= 2.47.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-4ggg-h7ph-26qr/GHSA-4ggg-h7ph-26qr.json"