Cczlonkowski

Products

Exploited and recent CVEs

• CVE-2026-55608 Medium 4.2 n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode 0.3%
• CVE-2026-54052 Critical 9.9 n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments 0.4%
• CVE-2026-45582 Medium 6.5 n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters 0.3%
• CVE-2026-45707 High 8.1 n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete 0.2%
• CVE-2026-44694 High 7.2 n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths 0.2%
• CVE-2026-42282 Medium 4.3 n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode 0.3%
• CVE-2026-41495 Medium 5.3 n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests 0.3%
• CVE-2026-42449 High 8.5 n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders 0.2%
• CVE-2026-39974 High 8.5 n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode 0.3%