CVE-2026-44694: n8n-mcp webhook and API client paths has an authenticated SSRF

May 8, 2026 (updated May 13, 2026)

Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode.

References

github.com/advisories/GHSA-cmrh-wvq6-wm9r
github.com/czlonkowski/n8n-mcp/commit/bcaba839409d470abeb4a6ad9b361b553a1098eb
github.com/czlonkowski/n8n-mcp/releases/tag/v2.50.2
github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-cmrh-wvq6-wm9r
nvd.nist.gov/vuln/detail/CVE-2026-44694

Code Behaviors & Features

Detect and mitigate CVE-2026-44694 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →