CVE-2026-44694 n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths
Authenticated attackers can exploit SSRF in n8n-MCP webhook and API client paths to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44694?
CVE-2026-44694 is a high-severity server-side request forgery vulnerability in czlonkowski n8n-mcp, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.
Which versions are affected by CVE-2026-44694?
2 open source packages ship an affected version, including n8n-mcp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
n8n-mcp npm | From 2.18.7 | 2.50.2 |
n8n-mcp npm | From 2.18.7 | 2.50.2 |
Products include N8n-Mcp N8n-Mcp.
How do I fix CVE-2026-44694?
Upgrade n8n-mcp to 2.50.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-44694 being exploited?
There is no known exploitation of CVE-2026-44694 in the wild and no public exploit code.
Other vulnerabilities in czlonkowski n8n-mcp
- CVE-2026-54052 n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments
- CVE-2026-42449 n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
- CVE-2026-39974 n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode
- CVE-2026-45707 n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
- CVE-2026-45582 n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters
Sources
Also known as GHSA-cmrh-wvq6-wm9r.