{"id":"GHSA-75hx-xj24-mqrw","summary":"n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport","details":"### Summary\n\nSeveral HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.\n\n### Impact\n\nAn unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.\n\n### Patches\n\nFixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it.\n- **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.\n\nUpgrading to v2.47.6 is still strongly recommended.\n\n### Credit\n\nReported by @yotampe-pluto.","modified":"2026-04-10T21:21:11.279622Z","published":"2026-04-10T20:59:58Z","database_specific":{"cwe_ids":["CWE-306"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-04-10T20:59:58Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-75hx-xj24-mqrw"},{"type":"WEB","url":"https://github.com/czlonkowski/n8n-mcp/commit/ca9d4b3df6419b8338983be98f7940400f78bde3"},{"type":"PACKAGE","url":"https://github.com/czlonkowski/n8n-mcp"},{"type":"WEB","url":"https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.6"}],"affected":[{"package":{"name":"n8n-mcp","ecosystem":"npm","purl":"pkg:npm/n8n-mcp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.47.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-75hx-xj24-mqrw/GHSA-75hx-xj24-mqrw.json","last_known_affected_version_range":"\u003c= 2.47.5"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}]}