n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport

published 2026-04-10 7mo ago modified 2026-04-10 7mo ago

cvss: 8.2; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Summary

Several HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.

### Impact

An unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.

### Patches

Fixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.

### Workarounds

If you cannot upgrade immediately:

- **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it. - **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.

Upgrading to v2.47.6 is still strongly recommended.

### Credit

Reported by @yotampe-pluto.

Patch / fix

fixed in 1 links 2

npm n8n-mcp 2.47.6

github.com/czlonkowski/n8n-mcp@ca9d4b3 commit
github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.6 release

Is GHSA-75hx-xj24-mqrw in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	n8n-mcp	<2.47.6	2.47.6

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality

References

Sources

GitHub Advisory GHSA-75hx-xj24-mqrw

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.