← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-qm7x-j9xp-x3gv: Coordinated Vulnerability Disclosure Verification Record (czlonkowski/n8n-mcp)

[OFFICIALLY PUBLISHED BY VENDOR ON 2026-10-29T07:46:08Z • PATCHED IN v2.99.2 (COMMIT a49dfb4)]
Privately reported to czlonkowski/n8n-mcp via GitHub Private Vulnerability Reporting (GHSA-qm7x-j9xp-x3gv) covering SSRF Protection Bypass in validateUrlSync and validateWebhookUrl via Trailing-Dot FQDNs and RFC 6761 *.localhost Subdomains (CWE-918 / CWE-184, Defense-in-Depth CVSS 3.1 Low).
Confirmed and patched upstream in n8n-mcp v2.99.2 via commit a49dfb4 (merged in 09611fd) with official reporter credit to @ccsimplyspolit.

0x00 // GitHub CNA & Upstream Patch Metadata

{
  "ghsa_id": "GHSA-qm7x-j9xp-x3gv",
  "repository": "czlonkowski/n8n-mcp",
  "package": "npm:n8n-mcp",
  "vulnerable_version_range": "<= 2.99.1",
  "patched_versions": "2.99.2",
  "upstream_fix_commit": "https://github.com/czlonkowski/n8n-mcp/commit/a49dfb4",
  "upstream_merge_commit": "https://github.com/czlonkowski/n8n-mcp/commit/09611fd",
  "html_url": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-qm7x-j9xp-x3gv",
  "state": "published",
  "published_at": "2026-10-29T07:46:08Z",
  "summary": "Hostname checks in SSRF protection skipped trailing-dot and *.localhost names (validateUrlSync and validateWebhookUrl)",
  "severity": "low",
  "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "status": "Officially Published by Vendor (GHSA-qm7x-j9xp-x3gv) & Patched in v2.99.2 (commit a49dfb4)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-184",
    "CWE-918"
  ]
}