Threats tagged 'ghsa-56c3-vfp2-5qqj'

A Server-Side Request Forgery (SSRF) vulnerability exists in n8n-mcp versions 2.47.4 through 2.47.13 in the synchronous URL validator validateUrlSync(). It fails to check IPv4-mapped IPv6 addresses, allowing attackers supplying a crafted n8nApiUrl to bypass protections and make HTTP requests to cloud metadata services, private networks, or localhost. The vulnerability allows response data to be returned to the attacker and forwards the n8nApiKey header to the target. The issue is fixed in version 2.47.14.