8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42449

CVE-2026-42449: n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK embedder path (N8NDocumentationMCPServer constructor, getN8nApiClient(), and validateInstanceContext()), the synchronous URL validator in SSRFProtection.validateUrlSync() had no IPv6 checks. IPv4-mapped IPv6 addresses such as http://[::ffff:169.254.169.254] bypassed the cloud-metadata, localhost, and private-IP range checks. An attacker able to supply an n8nApiUrl value could cause the server to issue HTTP requests to cloud metadata endpoints, RFC1918 private networks, or localhost services. Response bodies are returned to the caller (non-blind SSRF), and the n8nApiKey is forwarded in the x-n8n-api-key header to the attacker-controlled target. Projects with deployments embedding n8n-mcp as an SDK using N8NDocumentationMCPServer or N8NMCPEngine with user-supplied InstanceContext are affected. The first-party HTTP server deployment was not primarily affected — it has a second async validator (validateWebhookUrl) that catches IPv6 addresses. This issue has been fixed in version 2.47.14. If users are unable to upgrade immediately as a workaround they can validate URLs before passing to the SDK, restrict egress at the network layer, and reject user-controlled n8nApiUrl values.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42449

CVE-2026-42449:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n-mcp	npm	>= 2.47.4, < 2.47.14	2.47.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the n8n-mcp library, specifically within the SSRFProtection.validateUrlSync function. The root cause was the lack of validation for IPv4-mapped IPv6 addresses. An attacker could provide a URL like http://[::ffff:169.254.169.254] to bypass the existing SSRF filters, which only checked for standard IPv4 private ranges and localhost addresses. This allowed the attacker to make the server issue requests to internal network resources, including cloud metadata services (like AWS IMDS), and retrieve the responses.

The patch addresses this by introducing a new helper function, isPrivateOrMappedIpv6, which specifically checks for a wide range of private, reserved, and mapped IPv6 address patterns that could be used for malicious purposes. This new, stricter validation is then applied to both the synchronous validateUrlSync function (the primary source of the vulnerability) and the asynchronous validateWebhookUrl function, replacing its previous, less complete IPv6 checks. The key vulnerable function is validateUrlSync because it was the entry point for the SSRF in the SDK embedder path.

Vulnerable functions

SSRFProtection.validateUrlSync

src/utils/ssrf-protection.ts

This function is the core of the vulnerability. Before the patch, it lacked checks for IPv4-mapped IPv6 addresses, allowing an attacker to bypass SSRF protections. The patch adds a call to the new `isPrivateOrMappedIpv6` function to block these malicious URLs.

SSRFProtection.validateWebhookUrl

src/utils/ssrf-protection.ts

Although the advisory states this asynchronous validator was less affected, the patch replaces its existing, less comprehensive IPv6 checks with the new, more robust `isPrivateOrMappedIpv6` function. This indicates the original implementation was also weak and could potentially be bypassed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.