{"id":"GHSA-75hx-xj24-mqrw","aliases":[],"url":"https://o3.security/vulnerability/GHSA-75hx-xj24-mqrw","summary":"n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport","details":"### Summary\n\nSeveral HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.\n\n### Impact\n\nAn unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.\n\n### Patches\n\nFixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it.\n- **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.\n\nUpgrading to v2.47.6 is still strongly recommended.\n\n### Credit\n\nReported by @yotampe-pluto.","published":"2026-04-10T20:59:58Z","modified":"2026-04-10T21:21:11.279622Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"n8n-mcp","fixedVersion":"2.47.6"}],"fix":{"url":"https://github.com/czlonkowski/n8n-mcp/commit/ca9d4b3df6419b8338983be98f7940400f78bde3","label":"czlonkowski/n8n-mcp@ca9d4b3"},"references":[{"type":"WEB","url":"https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-75hx-xj24-mqrw"},{"type":"WEB","url":"https://github.com/czlonkowski/n8n-mcp/commit/ca9d4b3df6419b8338983be98f7940400f78bde3"},{"type":"PACKAGE","url":"https://github.com/czlonkowski/n8n-mcp"},{"type":"WEB","url":"https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.6"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-04-10T21:21:11.279622Z"}}