An AI-assisted security patch added a synchronous SSRF check that covered hostnames and IPv4 ranges but omitted private and IPv4-encoding IPv6 forms.

How AI contributed: Incomplete remediationPublished Apr 30, 2026 in czlonkowski/n8n-mcpAll 11 findings in this repository

Show full advisory description

The AI-assisted security patch added SSRFProtection.validateUrlSync in src/utils/ssrf-protection.ts to screen webhook URLs without DNS, but the helper covered only named metadata hosts, localhost names and IPv4 private ranges. Requests aimed at ::ffff:169.254.169.254, ::169.254.169.254, 2002:a9fe:a9fe:: or 64:ff9b::a9fe:a9fe passed validation and reached the HTTP client carrying the x-n8n-api-key header.

What actually happened

validateUrlSync screened the hostname for a small set of blocked names and IPv4 expressions, then declared the URL valid without ever classifying an IPv6 literal. The closing patch routes the hostname through isPrivateOrMappedIpv6 right before that final return, rejecting the ::/96 block along with link-local, site-local, unique-local, 6to4 and NAT64 encodings.

Case facts

CVE ID: CVE-2026-42449
GHSA ID: GHSA-56C3-VFP2-5QQJ
Published: Apr 30, 2026
Severity: Not scored
Language: TypeScript
AI tool: Claude
AI role: Incomplete remediation
Vulnerable release: >= 2.47.4, < 2.47.14
Fixed release: v2.47.14

Advisory source

Only the highlighted steps are this advisory. The first step is the earlier flaw the AI tried, and failed, to close.

Original flaw

Earlier advisory · CVE-2026-39974

The earlier AI-marked multi-tenant change accepted caller-controlled X-N8n-Url and X-N8n-Key headers and passed the selected instance URL and credential into the outbound n8n client without SSRF validation.

Sink: The authenticated multi-tenant HTTP path used the selected n8n instance URL for outbound requests and forwarded x-n8n-api-key to that destination.

Originally written by AI (czlonkowski)

424f8ae1ff

This advisoryCVE-2026-42449 (GHSA-56C3-VFP2-5QQJ)

AI tried to fix this

Added synchronous hostname and IPv4 private-address checks in SSRFProtection.validateUrlSync.

The AI-assisted change was a real security patch, but it left the same advisory reachable.

Missed: Did not cover IPv4-mapped or IPv4-compatible IPv6, 6to4, NAT64, ULA, link-local, or site-local addresses.

Incomplete AI-assisted fix · Claude

d9d847f230

src/utils/ssrf-protection.ts

Fixed again

Extended the same synchronous validator across the missing IPv6 address families in version 2.47.14.

This is the patch that actually stops the same attack path.

Fix by Romuald Członkowski · no AI marker found

9639f75785

src/utils/ssrf-protection.ts

AI-assisted change

AI-assisted changesrc/utils/ssrf-protection.ts source czlonkowski/n8n-mcp@d9d847f230+62−0

@@ -184,4 +184,66 @@ export class SSRFProtection {       return { valid: false, reason: 'Invalid URL format' };     }   }

Show 9 hidden lines

++  /**+   * Synchronous URL validation with no DNS resolution.+   *+   * Suitable for sync callers that cannot await DNS lookups. Pair with+   * {@link validateWebhookUrl} at async boundaries for full protection.+   *+   * @param urlString - URL to validate (raw input, not parsed)+   * @returns Validation result with optional reason on failure

+   *+   * @security See GHSA-4ggg-h7ph-26qr.+   */+  static validateUrlSync(urlString: string): { valid: boolean; reason?: string } {+    if (typeof urlString !== 'string' || urlString.includes('#')) {+      return { valid: false, reason: 'URL fragments are not allowed' };+    }

Show 25 hidden lines

++    let url: URL;+    try {+      url = new URL(urlString);+    } catch {+      return { valid: false, reason: 'Invalid URL format' };+    }++    if (!['http:', 'https:'].includes(url.protocol)) {+      return { valid: false, reason: 'Invalid protocol. Only HTTP/HTTPS allowed.' };+    }++    if (url.username !== '' || url.password !== '') {+      return { valid: false, reason: 'Userinfo in URL is not allowed' };+    }++    let hostname = url.hostname.toLowerCase();+    if (hostname.startsWith('[') && hostname.endsWith(']')) {+      hostname = hostname.slice(1, -1);+    }++    if (CLOUD_METADATA.has(hostname)) {+      return { valid: false, reason: 'Cloud metadata endpoint blocked' };+    }+

+    const mode: SecurityMode = (process.env.WEBHOOK_SECURITY_MODE || 'strict') as SecurityMode;++    if (mode === 'permissive') {+      return { valid: true };+    }++    if (mode === 'strict' && LOCALHOST_PATTERNS.has(hostname)) {+      return { valid: false, reason: 'Localhost access is blocked in strict mode' };+    }++    if (PRIVATE_IP_RANGES.some(regex => regex.test(hostname))) {+      return {+        valid: false,+        reason: mode === 'strict'

Show 2 hidden lines

+          ? 'Private IP addresses not allowed'+          : 'Private IP addresses not allowed (use WEBHOOK_SECURITY_MODE=permissive if needed)'

+      };+    }++    return { valid: true };+  } }

The attempted security fix adds a synchronous validator that checks metadata hosts, localhost, and IPv4 ranges, but reaches success without classifying IPv6 forms.

Security fix

Fixsrc/utils/ssrf-protection.ts source czlonkowski/n8n-mcp@9639f75785+49−0

@@ -51,6 +52,55 @@ const PRIVATE_IP_RANGES = [ ];  export class SSRFProtection {

Show 12 hidden lines

+  /**+   * IPv6 addresses that must be blocked: loopback, unspecified, link-local,+   * unique-local, site-local (deprecated), IPv4-mapped, IPv4-compatible,+   * 6to4, and NAT64-mapped addresses. All of these either represent private+   * networks or embed an arbitrary IPv4 address that would bypass IPv4-only+   * SSRF checks.+   *+   * Hostname must be lowercased and bracket-stripped. WHATWG URL parser+   * canonicalizes IPv6 literals (zero compression, dotted-quad → hex pairs),+   * so prefix matching works against the normalized form.+   *+   * @security See GHSA-56c3-vfp2-5qqj. The sync validator previously had no

+   * IPv6 gate, letting `::ffff:169.254.169.254`, `::169.254.169.254`,+   * `2002:a9fe:a9fe::`, and `64:ff9b::a9fe:a9fe` reach the HTTP client.+   */+  private static isPrivateOrMappedIpv6(hostname: string): boolean {+    // Gate on net.isIPv6 so domain names starting with hex-like labels+    // (e.g. "fcexample.com") are never misclassified as private IPv6.+    if (!isIPv6(hostname)) return false;

Show 22 hidden lines

++    // ::/96 reserved block: unspecified (`::`), loopback (`::1`), IPv4-mapped+    // (`::ffff:X`), and deprecated IPv4-compatible (`::X:Y` per RFC 4291) all+    // live here. Blocking the whole prefix avoids enumerating subforms.+    if (hostname.startsWith('::')) return true;++    // Defensive long-form IPv4-mapped — WHATWG URL normally compresses this,+    // but keep the check in case normalization ever changes.+    if (hostname.startsWith('0:0:0:0:0:ffff:')) return true;++    // Link-local fe80::/10+    if (hostname.startsWith('fe80:')) return true;++    // Site-local fec0::/10 (deprecated, RFC 3879) — still honored by some stacks.+    if (/^fe[c-f]/.test(hostname)) return true;++    // Unique local fc00::/7 (RFC 4193). Covers fc00-fdff in the first hextet.+    if (/^f[cd]/.test(hostname)) return true;++    // 6to4 2002::/16 (RFC 3056) — bits 16-47 embed an arbitrary IPv4 address,+    // so any 2002: address can tunnel to RFC1918 or metadata endpoints.+    if (hostname.startsWith('2002:')) return true;

++    // NAT64 64:ff9b::/96 (RFC 6052) and 64:ff9b:1::/48 (RFC 8215) — embedded+    // IPv4 in the low 32 bits, same tunneling concern as 6to4.+    if (hostname.startsWith('64:ff9b:')) return true;++    return false;+  }

Show 4 hidden lines

+   /**    * Validate webhook URL for SSRF protection with configurable security modes    *

The closing patch adds a dedicated classifier for mapped, compatible, local, 6to4, and NAT64 IPv6 representations that the earlier IPv4 expressions could not recognize.

Fixsrc/utils/ssrf-protection.ts source czlonkowski/n8n-mcp@9639f75785+8−0

@@ -244,6 +289,14 @@ export class SSRFProtection {       };     }

Show 1 hidden lines

+    // SECURITY (GHSA-56c3-vfp2-5qqj): reject IPv4-mapped and private IPv6

+    // addresses. Without this, hostnames like `::ffff:169.254.169.254` or+    // `::ffff:127.0.0.1` pass the IPv4-only checks above and reach the HTTP+    // client.+    if (SSRFProtection.isPrivateOrMappedIpv6(hostname)) {+      return { valid: false, reason: 'IPv6 private/mapped address not allowed' };+    }+

Show 3 hidden lines

     return { valid: true };   } }

The synchronous validator now calls the IPv6 classifier immediately before its success return, directly closing the residual bypass on the same request boundary.

Patch fingerprints

AI-assisted change 825ff67214187288f214e3fdee477e26157bfe7677ddf06f0e92aae1e5eeb349 · Fix 9c937f9e6c8f88910119fedef32eabe1b96e0b4d2bc9a86c61f34c2f3420405c