n8n-mcp webhook and API client paths has an authenticated SSRF
Published May 8, 2026 · Updated Nov 3, 2026
Original summary
Normalized public record · Updated Nov 3, 2026
n8n-mcp webhook and API client paths has an authenticated SSRF
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client (N8NAPIURL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode.
Potential impact
A caller with access to the MCP session can drive HTTP requests from the n8n-mcp host to internal services and cloud metadata endpoints that the SSRF gate is meant to block. The response body is returned to the caller, making internal-service enumeration and credential theft immediate without any out-of-band channel. - Multi-tenant HTTP deployments where tenants share an AUTHTOKEN: any tenant with valid credentials can reach the operator's cloud metadata service and exfiltrate temporary IAM / GCP service account / Azure managed-identity credentials. - Single-tenant deployments: indirect prompt injection through tool arguments reaches the same surface; an attacker who can influence the LLM's tool calls can read internal services from the n8n-mcp host. - Stdio deployments are reachable via the same prompt-injection path.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- MEDIUM
- Confidence
- Not available
- Aliases
- None reported
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
Record history
Published May 8, 2026 · Last refreshed Nov 3, 2026