AI Threat Alert
GHSA-75hx-xj24-mqrw: n8n-mcp: unauthenticated HTTP endpoints enable DoS + recon
GHSA-75hx-xj24-mqrw HIGHThe n8n-mcp HTTP transport exposed MCP session management endpoints without any authentication and leaked operational metadata via an unprotected health check, allowing any network-reachable attacker to terminate active MCP sessions and enumerate system state. For organizations running AI agent workflows through n8n — where MCP is the integration layer between LLMs and external tools — session disruption halts AI pipelines mid-execution, which can mean broken automations, failed compliance workflows, or interrupted agentic tasks. With a CVSS of 8.2, no privileges required, and trivial network-based exploitation, the risk of opportunistic attack on exposed instances is non-trivial; no public exploit exists yet and it is not in CISA KEV, but 58 prior CVEs in this package signal a pattern of recurring security debt worth monitoring. Patch to v2.47.6 immediately, or restrict HTTP access via firewall/reverse proxy allowlist, or switch to stdio mode (`MCP_MODE=stdio`) which eliminates the HTTP attack surface entirely.
What is the risk?
HIGH risk for organizations with externally or internally exposed n8n-mcp HTTP servers. CVSS 8.2 with AV:N/AC:L/PR:N/UI:N means zero-friction exploitation for any attacker with network access — no credentials, no special knowledge, no user interaction required. Availability impact is HIGH (full session disruption), confidentiality is LOW (metadata only). The OpenSSF scorecard of 5.9/10 and 58 prior CVEs in the same package indicate systemic security hygiene issues. No active exploitation observed, but the trivial nature of the attack lowers the bar significantly for exploitation once attackers enumerate exposed deployments.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | <= 2.47.5 | 2.47.6 |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
5 steps-
Patch immediately
Upgrade n8n-mcp to v2.47.6 — all MCP session endpoints now require Bearer token authentication and the health check returns minimal liveness data only.
-
Network restriction (if patching is delayed)
Apply firewall rules or reverse proxy IP allowlists so only trusted clients reach the n8n-mcp HTTP server.
-
Switch to stdio mode
Set
MCP_MODE=stdioto eliminate the HTTP transport entirely — stdio does not expose any HTTP endpoints and is unaffected. -
Detection
Review HTTP access logs for unauthenticated requests to
/health,/session, or/mcpendpoints originating from unexpected source IPs. -
Audit exposure
Identify all instances running n8n-mcp <= 2.47.5 in your environment, prioritizing any exposed beyond the internal network perimeter.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is GHSA-75hx-xj24-mqrw?
The n8n-mcp HTTP transport exposed MCP session management endpoints without any authentication and leaked operational metadata via an unprotected health check, allowing any network-reachable attacker to terminate active MCP sessions and enumerate system state. For organizations running AI agent workflows through n8n — where MCP is the integration layer between LLMs and external tools — session disruption halts AI pipelines mid-execution, which can mean broken automations, failed compliance workflows, or interrupted agentic tasks. With a CVSS of 8.2, no privileges required, and trivial network-based exploitation, the risk of opportunistic attack on exposed instances is non-trivial; no public exploit exists yet and it is not in CISA KEV, but 58 prior CVEs in this package signal a pattern of recurring security debt worth monitoring. Patch to v2.47.6 immediately, or restrict HTTP access via firewall/reverse proxy allowlist, or switch to stdio mode (`MCP_MODE=stdio`) which eliminates the HTTP attack surface entirely.
Is GHSA-75hx-xj24-mqrw actively exploited?
No confirmed active exploitation of GHSA-75hx-xj24-mqrw has been reported, but organizations should still patch proactively.
How to fix GHSA-75hx-xj24-mqrw?
1. **Patch immediately**: Upgrade n8n-mcp to v2.47.6 — all MCP session endpoints now require Bearer token authentication and the health check returns minimal liveness data only. 2. **Network restriction (if patching is delayed)**: Apply firewall rules or reverse proxy IP allowlists so only trusted clients reach the n8n-mcp HTTP server. 3. **Switch to stdio mode**: Set `MCP_MODE=stdio` to eliminate the HTTP transport entirely — stdio does not expose any HTTP endpoints and is unaffected. 4. **Detection**: Review HTTP access logs for unauthenticated requests to `/health`, `/session`, or `/mcp` endpoints originating from unexpected source IPs. 5. **Audit exposure**: Identify all instances running n8n-mcp <= 2.47.5 in your environment, prioritizing any exposed beyond the internal network perimeter.
What systems are affected by GHSA-75hx-xj24-mqrw?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM tool orchestration, workflow automation with AI integration, MCP-based AI tool servers.
What is the CVSS score for GHSA-75hx-xj24-mqrw?
GHSA-75hx-xj24-mqrw has a CVSS v3.1 base score of 8.2 (HIGH).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0006 Active Scanning AML.T0029 Denial of AI Service AML.T0049 Exploit Public-Facing Application AML.T0053 AI Agent Tool Invocation AML.T0084 Discover AI Agent Configuration Compliance Controls Affected
What are the technical details?
Original Advisory
### Summary Several HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials. ### Impact An unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks. ### Patches Fixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response. ### Workarounds If you cannot upgrade immediately: - **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it. - **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability. Upgrading to v2.47.6 is still strongly recommended. ### Credit Reported by @yotampe-pluto.
Exploitation Scenario
An attacker performs a port scan or scrapes Shodan/Censys for exposed n8n-mcp HTTP servers (default port). They first query the unauthenticated `/health` endpoint to confirm the target is running n8n-mcp and extract operational metadata — active session counts, server version, uptime — enabling reconnaissance without triggering most auth-based alerts. Armed with session context, they send unauthenticated DELETE or POST requests to MCP session endpoints, forcibly terminating active sessions. This disrupts any LLM agent tasks mid-execution: half-completed tool calls fail, dependent automation workflows abort, and AI-driven business processes stall. In a targeted attack, the disruption is timed to coincide with a critical operation (e.g., automated compliance report generation or real-time security monitoring using AI agents).
Weaknesses (CWE)
CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- [Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H References
Timeline
Related Vulnerabilities
CVE-2026-33663 10.0 n8n: member role steals plaintext HTTP credentials
Same package: n8n CVE-2026-33660 10.0 TensorFlow: type confusion NPD in tensor conversion
Same package: n8n CVE-2026-21858 10.0 n8n: Input Validation flaw enables exploitation
Same package: n8n CVE-2026-27577 9.9 n8n: Code Injection enables RCE
Same package: n8n CVE-2026-27494 9.9 n8n: security flaw enables exploitation
Same package: n8n