Czlonkowski vulnerabilities
We track 5 vulnerabilities in Czlonkowski products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 15, 2026.
Latest Czlonkowski vulnerabilities
- 9.9 Critical severity
n8n-mcp: Authorization Bypass Through User-Controlled Key
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were
- 8.1 High severity
n8n-mcp: Improper Access Control
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.2, when ENABLE_MULTI_TENANT=true, the HTTP transport documents that the target n8n instance is selected per-request from x-n8n-url
- 9.1 Critical severity
n8n-mcp: Time-of-check Time-of-use (TOCTOU) Race Condition
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger t
- 8.5 High severity
n8n-mcp: Server-Side Request Forgery
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK embedder path (N8NDocumentationMCPServer constructor, getN8nApiClient(), and validateInstanceContext(
- 8.5 High severity
n8n-mcp: Server-Side Request Forgery
n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a val