{"id":"EUVD-2026-20968","enisaUuid":"adfab889-0b51-3a20-992f-ba64cc2f7509","description":"n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTH_TOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the contents of any URL the server can reach — including cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and any other host the server process has network access to. The primary at-risk deployments are multi-tenant HTTP installations where more than one operator can present a valid AUTH_TOKEN, or where a token is shared with less-trusted clients. Single-tenant stdio deployments and HTTP deployments without multi-tenant headers are not affected. This vulnerability is fixed in 2.47.4.","datePublished":"Apr 9, 2026, 4:45:20 PM","dateUpdated":"Apr 13, 2026, 8:09:26 PM","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-4ggg-h7ph-26qr\nhttps://github.com/czlonkowski/n8n-mcp/commit/d9d847f230923d96e0857ccecf3a4dedcc9b0096\nhttps://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.4\n","aliases":"CVE-2026-39974\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"3b17dd87-6154-3592-a122-7e1e20892fb3","product":{"name":"n8n-mcp","vendor":{"name":"czlonkowski"}},"product_version":"\u003c 2.47.4"}],"enisaIdVendor":[{"id":"1cf4ae83-36e7-337c-a5e9-e91733f31077","vendor":{"name":"czlonkowski"}}],"enisaIdVulnerability":[{"id":"930be794-ad9e-3623-b758-590c3819763a","vulnerability":{"id":"GHSA-4ggg-h7ph-26qr","description":"n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode","datePublished":"Apr 8, 2026, 7:53:48 PM","dateUpdated":"Apr 9, 2026, 7:05:56 PM","baseScore":0.0,"references":"https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-4ggg-h7ph-26qr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39974\nhttps://github.com/czlonkowski/n8n-mcp/commit/d9d847f230923d96e0857ccecf3a4dedcc9b0096\nhttps://github.com/czlonkowski/n8n-mcp\nhttps://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.4\n","enisa_id":"EUVD-2026-20968\n","aliases":"CVE-2026-39974\nGHSA-4ggg-h7ph-26qr\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b1a46f25-c6f4-3be8-ab5a-fa1c79904151","vulnerability":{"id":"CVE-2026-39974","description":"n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTH_TOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the contents of any URL the server can reach — including cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and any other host the server process has network access to. The primary at-risk deployments are multi-tenant HTTP installations where more than one operator can present a valid AUTH_TOKEN, or where a token is shared with less-trusted clients. Single-tenant stdio deployments and HTTP deployments without multi-tenant headers are not affected. This vulnerability is fixed in 2.47.4.","datePublished":"Apr 9, 2026, 4:45:20 PM","dateUpdated":"Apr 13, 2026, 8:09:26 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-4ggg-h7ph-26qr\nhttps://github.com/czlonkowski/n8n-mcp/commit/d9d847f230923d96e0857ccecf3a4dedcc9b0096\nhttps://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.4\n","enisa_id":"EUVD-2026-20968\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Oct 27, 2026, 7:13:18 AM","vulnerabilityProduct":[{"id":"bb0d2b62-e8a8-349a-8947-636250f9b904","product":{"name":"n8n-mcp","vendor":{"name":"czlonkowski"}},"product_version":"\u003c 2.47.4"}],"vulnerabilityVendor":[{"id":"9ab9cd0a-2e58-369f-86af-498a1898b2ee","vendor":{"name":"czlonkowski"}}]}}],"enisaIdAdvisory":[]}