Skip to content
OpenAdvisories

Vendor

czlonkowski

9 known vulnerabilities.

Products

n8n-mcp 9
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.1
    CVE-2026-45707

    n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

    n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.2, when ENABLE_MULTI_TENANT=true, the HTTP transport documents that the target n8n instance is selected per-request from x-n8n-url…

    czlonkowski n8n-mcp n8n-mcp npm
  • High 7.2
    CVE-2026-44694

    n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths

    n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger …

    czlonkowski n8n-mcp n8n-mcp npm
  • High 8.5
    CVE-2026-42449

    n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

    n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK embedder path (N8NDocumentationMCPServer constructor, getN8nApiClient(), and validateInstanceContext…

    czlonkowski n8n-mcp n8n-mcp npm
  • High 8.5
    CVE-2026-39974

    n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode

    n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a va…

    czlonkowski n8n-mcp n8n-mcp npm