The n8n-mcp component before version 2.50.1 contains three distinct vulnerabilities. First, caller-supplied workflow identifiers are not validated before use as URL path segments, enabling authenticated MCP callers to craft requests that bypass handler-level access controls and access other same-origin endpoints with the n8n API key. Second, webhook, form, and chat trigger URLs that pass validation may follow redirects to hosts that would normally be rejected, resulting in non-blind SSRF with response data returned to the caller. Third, telemetry data uploads include unredacted partial-update operation diffs, potentially exposing sensitive node parameters such as bearer tokens, API keys, and webhook secrets. These issues have a CVSS 3.1 score of 8.3 (High).

An authenticated MCP caller with access to the n8n API integration can exploit these vulnerabilities to bypass access controls, perform server-side request forgery that returns response data, and expose sensitive credentials through telemetry data. This can lead to unauthorized access to internal endpoints, data leakage, and compromise of secrets used within workflows.

A fix is available in n8n-mcp version 2.50.1 and later; upgrading to this version is recommended. As workarounds, restrict network access to the MCP HTTP port to trusted callers via firewall, reverse-proxy ACL, or VPN, or switch to stdio mode to eliminate the HTTP surface for the first two issues. To mitigate telemetry payload exposure, disable telemetry by setting the environment variable N8N_MCP_TELEMETRY_DISABLED=true before starting the server or run 'npx n8n-mcp telemetry disable'.