Product by Czlonkowski
N8n-mcp
9 known vulnerabilities in N8n-mcp (Czlonkowski), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-54052 | n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments | 9.9 | |
| Critical | CVE-2026-44694 | n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths | 9.1 | |
| High | CVE-2026-39974 | n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode | 8.5 | |
| High | CVE-2026-42449 | Czlonkowski N8n-mcp: Server-Side Request Forgery (SSRF) | 8.5 | |
| High | CVE-2026-45707 | Czlonkowski N8n-mcp: Improper Access Control | 8.1 | |
| Medium | CVE-2026-45582 | n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters | 6.5 | |
| Medium | CVE-2026-55608 | Czlonkowski N8n-mcp: Exposure of Sensitive Information to an Unauthorized Actor | 5.4 | |
| Medium | CVE-2026-41495 | n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests | 5.3 | |
| Medium | CVE-2026-42282 | n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode | 4.3 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,