Improper access control in n8n - #VU139108
Published: July 22, 2026
Vulnerability identifier: #VU139108
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: n8n
Affected software:
n8n
n8n
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information from internal or otherwise blocked hosts.
The vulnerability exists due to improper access control in the MCP Client node when sending requests to a user-supplied endpoint. A remote user can create or edit a workflow that causes the server to connect to internal or otherwise blocked hosts and read the responses back through the workflow to disclose sensitive information from internal or otherwise blocked hosts.
Only instances with SSRF protection enabled are vulnerable.
Remediation
Install security update from vendor's website.