CVE-2026-39974 n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode
Authenticated attackers can exploit SSRF in multi-tenant mode to read internal network data and cloud metadata via crafted headers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39974?
CVE-2026-39974 is a high-severity server-side request forgery vulnerability in czlonkowski n8n-mcp, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTH_TOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the contents of any URL the server can reach — including cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and any other host the server process has network access to. The primary at-risk deployments are multi-tenant HTTP installations where more than one operator can present a valid AUTH_TOKEN, or where a token is shared with less-trusted clients. Single-tenant stdio deployments and HTTP deployments without multi-tenant headers are not affected. This vulnerability is fixed in 2.47.4.
Weakness: CWE-918
Which versions are affected by CVE-2026-39974?
2 open source packages ship an affected version, including n8n-mcp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
n8n-mcp npm | All versions | 2.47.4 |
n8n-mcp npm | All versions | 2.47.4 |
Products include N8n-Mcp N8n-Mcp.
How do I fix CVE-2026-39974?
Upgrade n8n-mcp to 2.47.4 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-39974 being exploited?
There is no known exploitation of CVE-2026-39974 in the wild and no public exploit code.
Other vulnerabilities in czlonkowski n8n-mcp
- CVE-2026-54052 n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments
- CVE-2026-42449 n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
- CVE-2026-45707 n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
- CVE-2026-44694 n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths
- CVE-2026-45582 n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters
Sources
Also known as GHSA-4ggg-h7ph-26qr.