CVE-2026-42449 - Vulnerability Analysis

Overview

n8n-MCP 2.47.4 through 2.47.13 contains a server-side request forgery caused by missing IPv6 checks in synchronous URL validation, letting attackers supply n8nApiUrl to access internal cloud metadata and private network endpoints, exploit requires attacker to supply n8nApiUrl value.

Severity & Score

Impact

Attackers can make the server send requests to internal services and retrieve sensitive data including API keys.

Mitigation

Upgrade to version 2.47.14 or later; alternatively validate URLs before passing to SDK and restrict network egress.

References

• https://github.com/czlonkowski/n8n-mcp/commit/9639f757853149f0cb16663cc8b6b6468f27a25f
• https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-56c3-vfp2-5qqj

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner