{"answers":{"affected":"2 open source packages ship an affected version, including n8n-mcp.","exploited":"There is no known exploitation of GHSA-8g7g-hmwm-6rv2 in the wild and no public exploit code.","fix":"Upgrade n8n-mcp to 2.50.1 or later.","what":"GHSA-8g7g-hmwm-6rv2 is a server-side request forgery vulnerability in n8n-mcp, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-8g7g-hmwm-6rv2 and fix it if it is affected.\n\nWhat it is: GHSA-8g7g-hmwm-6rv2 is a server-side request forgery vulnerability in n8n-mcp, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-8g7g-hmwm-6rv2 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- n8n-mcp (npm): affected all versions; fixed in 2.50.1\n- n8n-mcp (npm): affected all versions; fixed in 2.50.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-8g7g-hmwm-6rv2/ (Markdown: https://insights.sbomify.com/GHSA-8g7g-hmwm-6rv2/index.md)","id":"GHSA-8g7g-hmwm-6rv2","markdown":"https://insights.sbomify.com/GHSA-8g7g-hmwm-6rv2/index.md","name":"GHSA-8g7g-hmwm-6rv2","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"n8n MCP integration","requires_auth":"low_privilege","summary":"Authenticated attackers can exploit SSRF and path traversal to access internal endpoints and leak sensitive API keys via telemetry.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Impact\n\n`n8n-mcp` versions before 2.50.1 contained three independently-reported issues affecting deployments that run the n8n API integration:\n\n1. **Caller-supplied identifiers were not validated before being used as URL path segments** by the n8n API client. An authenticated MCP caller passing a crafted workflow id could cause outbound requests carrying the configured n8n API key to land on other same-origin endpoints, bypassing handler-level access controls (including `DISABLED_TOOLS`).\n\n2. **Validated webhook, form, and chat trigger URLs followed redirects.** A URL that passed initial validation could redirect the outbound request to a host that would otherwise have been rejected, with the response body returned to the caller. Reachable as non-blind SSRF over authenticated MCP calls.\n\n3. **Mutation telemetry stored unredacted operation payloads.** On instances running with the default opt-in telemetry, partial-update operation diffs were uploaded without redaction. Operation values can carry the same node-parameter values the workflow contains, including bearer tokens, API keys, and webhook secrets.\n\n## Severity\n\nCVSS 8.3 (HIGH). Exploitation requires an authenticated MCP caller and an n8n API integration configured with an n8n API key.\n\n## Patched versions\n\nUpgrade to `n8n-mcp \u003e= 2.50.1`.\n\n## Workarounds\n\n- For issues (1) and (2): restrict network access to the HTTP transport (firewall, reverse-proxy ACL, or VPN) so only trusted callers can reach the MCP HTTP port; or switch to stdio mode, which exposes no HTTP surface for these issues.\n- For issue (3): set `N8N_MCP_TELEMETRY_DISABLED=true` in the environment before starting the server, or run `npx n8n-mcp telemetry disable` once.\n\n## Credit\n\nReported by @cybercraftsolutionsllc.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure","id":"GHSA-8g7g-hmwm-6rv2","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"ssrf","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["2.50.1"],"introduced":["0"],"last_affected":[],"package":"n8n-mcp","purl":null,"source":"GHSA-8g7g-hmwm-6rv2"},{"ecosystem":"npm","fixed":["2.50.1"],"introduced":["0"],"last_affected":[],"package":"n8n-mcp","purl":"pkg:npm/n8n-mcp","source":"GHSA-8g7g-hmwm-6rv2"}],"products":null,"published":"2026-05-08","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated attackers can exploit SSRF and path traversal to access internal endpoints and leak sensitive API keys via telemetry.","url":"https://insights.sbomify.com/GHSA-8g7g-hmwm-6rv2/"}