Vulnerability Details CVE-2026-44694
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 3.2%
CVSS Severity
CVSS v3 Score 9.1
References
Products affected by CVE-2026-44694
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.18.10
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.18.7
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.18.8
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.18.9
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.19.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.19.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.19.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.19.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.19.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.19.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.19.6
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.20.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.20.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.20.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.20.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.20.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.20.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.20.6
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.20.7
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.20.8
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.21.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.21.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.10
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.11
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.12
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.13
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.14
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.15
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.16
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.17
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.18
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.19
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.20
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.21
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.6
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.7
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.8
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.22.9
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.23.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.24.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.24.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.26.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.26.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.26.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.26.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.26.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.26.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.27.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.27.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.27.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.28.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.28.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.28.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.28.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.28.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.28.6
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.28.7
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.28.8
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.28.9
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.29.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.29.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.29.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.29.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.29.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.30.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.30.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.30.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.6
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.7
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.8
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.31.9
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.32.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.32.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.33.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.33.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.33.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.33.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.33.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.33.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.33.6
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.34.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.34.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.34.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.34.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.34.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.34.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.35.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.35.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.35.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.35.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.35.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.35.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.35.6
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.36.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.36.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.36.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.37.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.37.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.37.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.37.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.38.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.40.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.40.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.40.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.40.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.40.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.40.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.41.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.41.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.41.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.41.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.41.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.42.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.42.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.42.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.42.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.43.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.44.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.44.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.45.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.45.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.46.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.46.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.10
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.11
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.12
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.13
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.14
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.4
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.5
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.6
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.7
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.8
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.47.9
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.48.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.48.1
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.48.2
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.48.3
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.49.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.50.0
-
cpe:2.3:a:n8n-mcp:n8n-mcp:2.50.1