AI Threat Alert
GHSA-75hx-xj24-mqrw: n8n-mcp: unauthenticated HTTP endpoints enable DoS + recon
GHSA-75hx-xj24-mqrw HIGHThe n8n-mcp HTTP transport exposed MCP session management endpoints without any authentication and leaked operational metadata via an unprotected health check, allowing any network-reachable attacker to terminate active MCP sessions and enumerate system state. For organizations running AI agent workflows through n8n — where MCP is the integration layer between LLMs and external tools — session disruption halts AI pipelines mid-execution, which can mean broken automations, failed compliance workflows, or interrupted agentic tasks. With a CVSS of 8.2, no privileges required, and trivial network-based exploitation, the risk of opportunistic attack on exposed instances is non-trivial; no public exploit exists yet and it is not in CISA KEV, but 58 prior CVEs in this package signal a pattern of recurring security debt worth monitoring. Patch to v2.47.6 immediately, or restrict HTTP access via firewall/reverse proxy allowlist, or switch to stdio mode (`MCP_MODE=stdio`) which eliminates the HTTP attack surface entirely.
Risk Assessment
HIGH risk for organizations with externally or internally exposed n8n-mcp HTTP servers. CVSS 8.2 with AV:N/AC:L/PR:N/UI:N means zero-friction exploitation for any attacker with network access — no credentials, no special knowledge, no user interaction required. Availability impact is HIGH (full session disruption), confidentiality is LOW (metadata only). The OpenSSF scorecard of 5.9/10 and 58 prior CVEs in the same package indicate systemic security hygiene issues. No active exploitation observed, but the trivial nature of the attack lowers the bar significantly for exploitation once attackers enumerate exposed deployments.
Attack Kill Chain
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n-mcp | npm | <= 2.47.5 | 2.47.6 |
Do you use n8n-mcp? You're affected.
Severity & Risk
Attack Surface
Recommended Action
- **Patch immediately**: Upgrade n8n-mcp to v2.47.6 — all MCP session endpoints now require Bearer token authentication and the health check returns minimal liveness data only. 2. **Network restriction (if patching is delayed)**: Apply firewall rules or reverse proxy IP allowlists so only trusted clients reach the n8n-mcp HTTP server. 3. **Switch to stdio mode**: Set `MCP_MODE=stdio` to eliminate the HTTP transport entirely — stdio does not expose any HTTP endpoints and is unaffected. 4. **Detection**: Review HTTP access logs for unauthenticated requests to `/health`, `/session`, or `/mcp` endpoints originating from unexpected source IPs. 5. **Audit exposure**: Identify all instances running n8n-mcp <= 2.47.5 in your environment, prioritizing any exposed beyond the internal network perimeter.
Classification
Compliance Impact
This CVE is relevant to:
Frequently Asked Questions
What is GHSA-75hx-xj24-mqrw?
The n8n-mcp HTTP transport exposed MCP session management endpoints without any authentication and leaked operational metadata via an unprotected health check, allowing any network-reachable attacker to terminate active MCP sessions and enumerate system state. For organizations running AI agent workflows through n8n — where MCP is the integration layer between LLMs and external tools — session disruption halts AI pipelines mid-execution, which can mean broken automations, failed compliance workflows, or interrupted agentic tasks. With a CVSS of 8.2, no privileges required, and trivial network-based exploitation, the risk of opportunistic attack on exposed instances is non-trivial; no public exploit exists yet and it is not in CISA KEV, but 58 prior CVEs in this package signal a pattern of recurring security debt worth monitoring. Patch to v2.47.6 immediately, or restrict HTTP access via firewall/reverse proxy allowlist, or switch to stdio mode (`MCP_MODE=stdio`) which eliminates the HTTP attack surface entirely.
Is GHSA-75hx-xj24-mqrw actively exploited?
No confirmed active exploitation of GHSA-75hx-xj24-mqrw has been reported, but organizations should still patch proactively.
How to fix GHSA-75hx-xj24-mqrw?
1. **Patch immediately**: Upgrade n8n-mcp to v2.47.6 — all MCP session endpoints now require Bearer token authentication and the health check returns minimal liveness data only. 2. **Network restriction (if patching is delayed)**: Apply firewall rules or reverse proxy IP allowlists so only trusted clients reach the n8n-mcp HTTP server. 3. **Switch to stdio mode**: Set `MCP_MODE=stdio` to eliminate the HTTP transport entirely — stdio does not expose any HTTP endpoints and is unaffected. 4. **Detection**: Review HTTP access logs for unauthenticated requests to `/health`, `/session`, or `/mcp` endpoints originating from unexpected source IPs. 5. **Audit exposure**: Identify all instances running n8n-mcp <= 2.47.5 in your environment, prioritizing any exposed beyond the internal network perimeter.
What systems are affected by GHSA-75hx-xj24-mqrw?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM tool orchestration, workflow automation with AI integration, MCP-based AI tool servers.
What is the CVSS score for GHSA-75hx-xj24-mqrw?
GHSA-75hx-xj24-mqrw has a CVSS v3.1 base score of 8.2 (HIGH).
Technical Details
NVD Description
### Summary Several HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials. ### Impact An unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks. ### Patches Fixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response. ### Workarounds If you cannot upgrade immediately: - **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it. - **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability. Upgrading to v2.47.6 is still strongly recommended. ### Credit Reported by @yotampe-pluto.
Exploitation Scenario
An attacker performs a port scan or scrapes Shodan/Censys for exposed n8n-mcp HTTP servers (default port). They first query the unauthenticated `/health` endpoint to confirm the target is running n8n-mcp and extract operational metadata — active session counts, server version, uptime — enabling reconnaissance without triggering most auth-based alerts. Armed with session context, they send unauthenticated DELETE or POST requests to MCP session endpoints, forcibly terminating active sessions. This disrupts any LLM agent tasks mid-execution: half-completed tool calls fail, dependent automation workflows abort, and AI-driven business processes stall. In a targeted attack, the disruption is timed to coincide with a critical operation (e.g., automated compliance report generation or real-time security monitoring using AI agents).
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H References
Timeline
Related Vulnerabilities
CVE-2026-33663 10.0 n8n: member role steals plaintext HTTP credentials
Same package: n8n CVE-2026-33660 10.0 TensorFlow: type confusion NPD in tensor conversion
Same package: n8n CVE-2026-21858 10.0 n8n: Input Validation flaw enables exploitation
Same package: n8n CVE-2025-68668 9.9 n8n: Protection Bypass circumvents security controls
Same package: n8n CVE-2026-27495 9.9 n8n: Code Injection enables RCE
Same package: n8n