n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 8, 2026 · NIST NVD

   Detected

   n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has bee

2. Jun 17, 2026 · NIST NVD

   Updated

   n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has bee

Affected

• cpe n8n-mcp/n8n-mcpversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-44694

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-44694

  n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API cl

  nvd.nist.gov

References

• Patch · github.com
• Product · github.com
• Mitigation · github.com