n8n-MCP vulnerabilities

In versions 2.47.4 through 2.47.13, n8n-MCP has a vulnerability related to the lack of IPv6 address validation in the URL validation function. An attacker can exploit this flaw to send HTTP requests to unauthorized endpoints, leading to data exposure.

In n8n-MCP prior to version 2.56.1, in HTTP mode with multi-tenancy enabled (ENABLE_MULTI_TENANT=true), local workflow version history backups were not isolated per tenant. This allowed an authenticated tenant to read and delete backups of other tenants, including full node definitions, credential references, and authorization headers.

n8n-MCP, an MCP server, has an authenticated server-side request forgery vulnerability affecting webhook trigger tools and the n8n API client. This issue exists in versions from 2.18.7 to before 2.50.2 and has been patched in version 2.50.2.

In n8n-MCP prior to version 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations.

In n8n-MCP prior to 2.51.2, when ENABLE_MULTI_TENANT=true, HTTP requests without x-n8n-url or x-n8n-key headers silently fell back to the operator's credentials, allowing an authenticated MCP tenant to execute n8n management calls against the operator's instance instead of its own.

In n8n-MCP prior to 2.51.3, the workflow telemetry sanitizer could retain partial fragments of URL-shaped node parameters, such as customer identifiers or secrets in query strings, before sending data to the anonymous telemetry backend. This is fixed in version 2.51.3.