CVE-2026-54309: n8n MCP Browser Auth Bypass Vulnerability

CVE-2026-54309 Overview

CVE-2026-54309 is a missing authentication vulnerability [CWE-306] in n8n, an open source workflow automation platform. The flaw affects the @n8n/mcp-browser component when started with the HTTP transport flag (--transport http). In this mode, the Model Context Protocol (MCP) endpoint accepts session initialization and tool invocation requests without authenticating the caller. Any network-reachable client, or any website the user visits, can open an MCP session and invoke browser-control tools. The issue is fixed in versions 2.25.7 and 2.26.2.

Critical Impact
Unauthenticated attackers can drive the victim's real browser profile through navigation, JavaScript evaluation, and cookie or storage access when the n8n AI Browser Bridge extension is active.

Affected Products

n8n @n8n/mcp-browser versions prior to 2.25.7
n8n @n8n/mcp-browser versions prior to 2.26.2
Deployments running @n8n/mcp-browser with --transport http and the n8n AI Browser Bridge extension installed

Discovery Timeline

2026-06-23 - CVE-2026-54309 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-54309

Vulnerability Analysis

The @n8n/mcp-browser component exposes an MCP endpoint used to broker browser automation requests between AI agents and a controlled browser session. When started with the HTTP transport, the endpoint listens for JSON-RPC style MCP traffic over HTTP. The endpoint does not validate any authentication material before accepting initialize calls or subsequent tool invocations. Any HTTP client that can reach the listening port can establish a session and call exposed browser tools.

When the n8n AI Browser Bridge extension is installed and connected to a live browser, those tools operate against the user's real browser profile. This grants the caller the ability to navigate to arbitrary URLs, execute JavaScript in page contexts, and read or write cookies and storage. The result is unauthenticated control over an authenticated browser session, which can lead to session theft, account takeover, and data exfiltration.

Root Cause

The root cause is the absence of an authentication or authorization check on the HTTP MCP transport handler [CWE-306]. The stdio transport relies on a local process boundary, but the HTTP transport inherits no equivalent control and shipped without bearer tokens, shared secrets, or origin validation.

Attack Vector

Two practical attack paths exist. A network-adjacent attacker who can reach the listening port can directly issue MCP requests. A remote attacker can also exploit the flaw through cross-site requests by luring the victim to a malicious page, which then issues requests to the local MCP endpoint and invokes browser-control tools against the victim's own browser profile.

No verified public proof-of-concept code is available. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-54309

Indicators of Compromise

Unexpected MCP initialize requests to the @n8n/mcp-browser HTTP listener from non-localhost or unfamiliar sources
Browser navigation events, script evaluations, or cookie reads in the AI Browser Bridge logs that do not map to a known n8n workflow execution
Outbound browser connections to attacker-controlled domains shortly after MCP tool invocations

Detection Strategies

Inspect the n8n host for processes started with the --transport http flag and identify which interface the listener is bound to
Correlate MCP tool invocation logs with authenticated user workflow activity and flag invocations that occur outside expected automation windows
Monitor HTTP access logs on the MCP port for requests originating from browsers or external IP ranges rather than backend services

Monitoring Recommendations

Alert on any inbound connection to the @n8n/mcp-browser HTTP port from non-loopback addresses
Track the running version of @n8n/mcp-browser across hosts and flag versions earlier than 2.25.7 or 2.26.2
Log and review all navigate, evaluate, and cookie/storage tool calls handled by the MCP browser server

How to Mitigate CVE-2026-54309

Immediate Actions Required

Upgrade @n8n/mcp-browser to 2.25.7 or 2.26.2, whichever matches your release branch
Audit all n8n deployments for processes invoked with --transport http and stop them until patched
Disconnect the n8n AI Browser Bridge extension from production browser profiles until the upgrade is complete

Patch Information

The maintainers fixed the issue in @n8n/mcp-browser versions 2.25.7 and 2.26.2. Patch notes and remediation guidance are published in the n8n GitHub Security Advisory GHSA-qrx8-25qr-5r7v.

Workarounds

Switch the MCP transport from HTTP back to stdio so the endpoint is not exposed over a network socket
Bind the HTTP listener strictly to 127.0.0.1 and block external access with host firewall rules
Place the MCP endpoint behind a reverse proxy that enforces authentication and origin checks until patches are deployed

bash

# Configuration example: restart mcp-browser using the stdio transport
npx @n8n/mcp-browser --transport stdio

# Or, if HTTP is required, restrict the listener to loopback and firewall the port
npx @n8n/mcp-browser --transport http --host 127.0.0.1 --port 3030
sudo iptables -A INPUT -p tcp --dport 3030 ! -s 127.0.0.1 -j DROP