n8n‑MCP implements a synchronous URL validator that is intended to prevent server‑side request forgery by rejecting URLs pointing to cloud‑metadata, localhost, or private IP ranges. The validator however does not support IPv6, allowing IPv4‑mapped IPv6 addresses such as http://[::ffff:169.254.169.254] to pass the check. As a result, an attacker who can influence the n8nApiUrl parameter can make the server issue HTTP requests to internal services or cloud‑metadata endpoints. The response body is returned to the caller and the attacker‑controlled target receives the n8nApiKey in a header, exposing sensitive credentials and enabling a full, non‑blind SSRF.

This flaw affects the n8n‑MCP server released by czlonkowski, specifically versions 2.47.4 through 2.47.13. The attack surface is the SDK embedder API (N8NDocumentationMCPServer or N8NMCPEngine) when a user supplies an InstanceContext that includes an n8nApiUrl. The main n8n HTTP server deployment is not directly affected because it uses an additional asynchronous validator that catches IPv6 addresses.

The CVSS score of 8.5 indicates a high severity vulnerability. There is no EPSS score available, and the issue is not yet catalogued in CISA KEV. If an attacker can supply the n8nApiUrl value, they can exploit the flaw by crafting a malicious InstanceContext that includes an IPv4‑mapped IPv6 address. Once injected, the server will fetch data from internal endpoints, return the content to the attacker, and forward the API key in a header, providing full access to privileged resources without authentication.