{"id":"EUVD-2026-38468","enisaUuid":"529e4576-54ec-310a-912f-fa42593a606e","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is active, an unauthenticated caller can access browser-control capabilities including navigation, JavaScript evaluation, and cookie and storage access against the user\u0027s real browser profile. This issue only affects instances where @n8n/mcp-browser is run with the HTTP transport (--transport http). This vulnerability is fixed in 2.25.7 and 2.26.2.","datePublished":"Jun 23, 2026, 3:36:13 PM","dateUpdated":"Jun 23, 2026, 3:45:15 PM","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-qrx8-25qr-5r7v\n","aliases":"CVE-2026-54309\nGHSA-qrx8-25qr-5r7v\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"b88113c9-eb55-3089-b888-0769baaf1b5c","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.25.7"},{"id":"cd2e5ec7-be19-3046-92b2-d2d0123b8c3e","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.2"}],"enisaIdVendor":[{"id":"6c311a85-d232-3697-b856-594047ae18fb","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"1e71ab20-be97-3380-95c0-02eee9a52248","vulnerability":{"id":"GHSA-qrx8-25qr-5r7v","description":"n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions","datePublished":"Jun 16, 2026, 11:32:31 PM","dateUpdated":"Jul 20, 2026, 1:39:49 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-qrx8-25qr-5r7v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54309\nhttps://github.com/n8n-io/n8n\n","enisa_id":"EUVD-2026-38468\n","aliases":"GHSA-qrx8-25qr-5r7v\nCVE-2026-54309\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"767da7c2-8001-37bd-9e04-9b540137f368","vulnerability":{"id":"CVE-2026-54309","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is active, an unauthenticated caller can access browser-control capabilities including navigation, JavaScript evaluation, and cookie and storage access against the user\u0027s real browser profile. This issue only affects instances where @n8n/mcp-browser is run with the HTTP transport (--transport http). This vulnerability is fixed in 2.25.7 and 2.26.2.","datePublished":"Jun 23, 2026, 3:36:13 PM","dateUpdated":"Jun 23, 2026, 3:45:15 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-qrx8-25qr-5r7v\n","enisa_id":"EUVD-2026-38468\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Nov 7, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"839e2bf7-d226-3dfa-b48a-789fb2edbb98","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.25.7"},{"id":"8d5e1619-da00-320b-8a01-126f400868d0","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.2"}],"vulnerabilityVendor":[{"id":"2c0a1fc8-e8b2-3eb1-af0c-1b95a92ef72f","vendor":{"name":"n8n-io"}}]}}],"enisaIdAdvisory":[{"id":"eca29475-cbf8-3d74-a303-1fc8e912ecaa","advisory":{"id":"NCSC-2026-0212","description":"Kwetsbaarheden verholpen in n8n workflow automation platform","datePublished":"Jun 29, 2026, 8:02:42 AM","dateUpdated":"Jun 29, 2026, 8:02:42 AM","baseScore":0.0,"references":"","aliases":"CVE-2026-54301\nCVE-2026-54302\nCVE-2026-54304\nCVE-2026-54305\nCVE-2026-54306\nCVE-2026-54307\nCVE-2026-54308\nCVE-2026-54309\nCVE-2026-54310\nCVE-2026-54311\nCVE-2026-54312\nCVE-2026-54313\nCVE-2026-54314\nCVE-2026-54303\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"9b0181f2-7f6b-3f30-80cf-cc01cf736196","product":{"name":"n8n","vendor":{"name":"n8n-io"}}}]}}]}