CVE-2026-42449

{
  "id": "CVE-2026-42449",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-07T21:16:30.133",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK embedder path (N8NDocumentationMCPServer constructor, getN8nApiClient(), and validateInstanceContext()), the synchronous URL validator in SSRFProtection.validateUrlSync() had no IPv6 checks. IPv4-mapped IPv6 addresses such as http://[::ffff:169.254.169.254] bypassed the cloud-metadata, localhost, and private-IP range checks. An attacker able to supply an n8nApiUrl value could cause the server to issue HTTP requests to cloud metadata endpoints, RFC1918 private networks, or localhost services. Response bodies are returned to the caller (non-blind SSRF), and the n8nApiKey is forwarded in the x-n8n-api-key header to the attacker-controlled target. Projects with deployments embedding n8n-mcp as an SDK using N8NDocumentationMCPServer or N8NMCPEngine with user-supplied InstanceContext are affected. The first-party HTTP server deployment was not primarily affected — it has a second async validator (validateWebhookUrl) that catches IPv6 addresses. This issue has been fixed in version 2.47.14. If users are unable to upgrade immediately as a workaround they can validate URLs before passing to the SDK, restrict egress at the network layer, and reject user-controlled n8nApiUrl values."
    },
    {
      "lang": "es",
      "value": "n8n-MCP es un servidor MCP que proporciona a los asistentes de IA acceso a la documentación, propiedades y operaciones de los nodos n8n. En las versiones 2.47.4 a 2.47.13, la ruta del incrustador del SDK (constructor N8NDocumentationMCPServer, getN8nApiClient() y validateInstanceContext()), el validador de URL síncrono en SSRFProtection.validateUrlSync() no tenía comprobaciones de IPv6. Direcciones IPv6 mapeadas a IPv4 como http://[::ffff:169.254.169.254] eludieron las comprobaciones de metadatos de la nube, localhost y rangos de IP privadas. Un atacante capaz de proporcionar un valor n8nApiUrl podría hacer que el servidor emitiera solicitudes HTTP a puntos finales de metadatos de la nube, redes privadas RFC1918 o servicios localhost. Los cuerpos de respuesta se devuelven al llamador (SSRF no ciego), y la n8nApiKey se reenvía en el encabezado x-n8n-api-key al objetivo controlado por el atacante. Los proyectos con implementaciones que incrustan n8n-mcp como un SDK utilizando N8NDocumentationMCPServer o N8NMCPEngine con InstanceContext proporcionado por el usuario se ven afectados. La implementación del servidor HTTP de primera parte no se vio afectada principalmente - tiene un segundo validador asíncrono (validateWebhookUrl) que detecta las direcciones IPv6. Este problema ha sido solucionado en la versión 2.47.14. Si los usuarios no pueden actualizar inmediatamente, como una solución alternativa pueden validar las URL antes de pasarlas al SDK, restringir la salida en la capa de red y rechazar los valores n8nApiUrl controlados por el usuario."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "czlonkowski",
          "product": "n8n-mcp",
          "versions": [
            {
              "version": ">= 2.47.4, < 2.47.14",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T14:15:26.183204Z",
          "id": "CVE-2026-42449",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.47.4",
              "versionEndExcluding": "2.47.14",
              "matchCriteriaId": "B7470D57-EE57-46A2-891E-759D3A81BB06"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/czlonkowski/n8n-mcp/commit/9639f757853149f0cb16663cc8b6b6468f27a25f",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-56c3-vfp2-5qqj",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}