AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions? What should I do?

    When @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication.

    Affected: n8n < 2.25.7 and >= 2.26.0, < 2.26.2. Fixed in: 2.25.7 and 2.26.2. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-54309-n8n-n8n-mcp-browser (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: n8n < 2.25.7 and >= 2.26.0, < 2.26.2. Fixed in: 2.25.7 and 2.26.2.

      • Check your version: run npm ls n8n. Versions >= 2.26.0, < 2.26.2 of n8n are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install n8n@2.26.2 (first patched version 2.26.2).
      2. Upgrade to n8n 2.25.7 or 2.26.2 or later.
      3. Avoid running @n8n/mcp-browser with the HTTP transport; use the default stdio transport instead.
      4. If HTTP transport is required, restrict network access to the listening port to trusted clients only using host-based firewall rules.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-54309-n8n-n8n-mcp-browser (opens external site)

      Did this work for you?

    Add your answer or comment