A flaw in n8n‑MCP allows an attacker who has authenticated to the system to craft requests that the server will forward to arbitrary URLs. The vulnerability appears in the webhook trigger tools, the API client path (N8N_API_URL), and URLs supplied via the x‑n8n‑url header when running in multi‑tenant mode. Once triggered, the server can reach internal or external resources, exposing confidential data, facilitating lateral movement, or disrupting services. The weakness is a classic Server‑Side Request Forgery (CWE‑918) and also involves improper handling of authenticated requests (CWE‑367).

The issue affects the n8n‑MCP server provided by czlonkowski. Versions from 2.18.7 up through the release preceding 2.50.2 are vulnerable. The patch that removes this flaw is included in n8n‑MCP version 2.50.2 and later.

The CVSS score is 7.2, placing the vulnerability in the medium‑to‑high severity range. Exploitation requires an authenticated user, so an internal attacker or a user with valid credentials can activate the SSRF. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, indicating no known active exploits at the time of analysis. Real‑world risk remains significant because of the potential for internal network reconnaissance or manipulation of external services.