n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport
Summary
Several HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.
Impact
An unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.
Patches
Fixed in v2.47.6. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.
Workarounds
If you cannot upgrade immediately:
- Restrict network access to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it.
- Use stdio mode (
MCP_MODE=stdio) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.
Upgrading to v2.47.6 is still strongly recommended.
Credit
Reported by @yotampe-pluto.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | n8n-mcp | < 2.47.6 | 2.47.6 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H- Weakness (CWE)
CWE-306- Platform
- npm
- Package
n8n-mcp- Disclosed
- 10.04.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-75hx-xj24-mqrw - CC BY 4.0
Vulnerability history: n8n-mcp
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 04.2026 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 6
- Medium 4
Disclosures per year
- 2026: 11
-
n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.