Authenticated Server‑Side Request Forgery exists in n8n‑MCP versions prior to 2.47.4. An operator holding a valid AUTH_TOKEN can supply an arbitrary URL in a multi‑tenant HTTP header; the server will issue an HTTP request to that URL and return the response body through JSON‑RPC. This flaw allows a threat actor who can obtain a token or share it with less‑trusted clients to read any content the server can reach, including cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and arbitrary hosts. The vulnerability is classified as CWE‑918 and can lead to significant confidentiality compromises and further exploitation after exposure of credentials or internal topology.

The vulnerability affects installations of n8n‑MCP up to and including version 2.47.3 that run in multi‑tenant HTTP mode. Deployments that are single‑tenant STDIO or HTTP without the multi‑tenant header are not affected. The issue is resolved in release 2.47.4, where the SSRF vector has been closed.

The CVSS score of 8.5 indicates high severity. The vulnerability requires authenticated access; thus the attacker must possess or acquire a valid AUTH_TOKEN. Once authenticated, the exploitation path is straightforward: supply a malicious instance‑URL header and read the reflected response. No exploit probability score is provided, and the vulnerability is not listed in CISA’s KEV catalog. The risk remains high for environments that share tokens with less‑trusted parties or have lax token control.