CVE-2026-44694 is a critical authenticated server side request forgery (CVSS 9.1) in n8n-MCP, an MCP server for n8n. A caller can make the host send requests to internal services and cloud metadata. Versions 2.18.7 up to 2.50.1 are affected. Upgrade to 2.50.2.
What's affected
From the project advisory for the n8n-mcp npm package:
- Affected: 2.18.7 up to, but not including, 2.50.2.
- Fixed: 2.50.2.
The advisory names three affected surfaces: the webhook trigger tools, the n8n API client configured by N8N_API_URL, and per request URLs sent in the x-n8n-url header in multi tenant HTTP mode. Multi tenant HTTP deployments where tenants share an auth token are called out as the worst case.
How to check if you're exposed
Check the installed version:
npm ls n8n-mcp
npx n8n-mcp --version
If you run it as a container or a service, read the version from the image tag or package lock. Then check how it is deployed: HTTP mode with several tenants, a single tenant, or stdio. Also check whether the host can reach a cloud metadata address.
What to do now
- Upgrade n8n-mcp to 2.50.2 or later.
- Read the operator note in the advisory. The SSRF check now covers the n8n API URL, so if n8n runs on localhost or a private address you need to set the webhook security mode to moderate or permissive, as the advisory explains.
- Do not share one auth token across tenants.
- Block access from the host to cloud metadata services where you can, for example by requiring the stricter metadata service settings of your cloud provider.
- Review which assistants can call the tools, since the advisory notes that prompt injection can drive the same requests.
Why it matters
The record lists CWE-918 (server side request forgery) and CWE-367 (time of check, time of use race condition). A server side request forgery makes your server act as the attacker's browser inside your network, which matters most when it can reach addresses the attacker cannot, such as internal admin pages and cloud credentials endpoints.
The advisory says the response body is returned to the caller, so no side channel is needed to read what comes back. That is why metadata credentials are a stated risk. The time of check issue means a name can resolve to a safe address during validation and an unsafe one when the request is made.
The record does not mark this CVE as KEV. The attack path also applies to single tenant setups through indirect prompt injection.
Quick check
Do stdio deployments need the fix?
The advisory says stdio deployments are reachable through the same prompt injection path, so yes.
Sources
Last reviewed: 19 October 2026.
