Summary
A critical authentication flaw in n8n’s MCP (Model Context Protocol) browser bridge — tracked as CVE-2026-54309 — allows any network-reachable attacker to establish unauthenticated MCP sessions and take full control of a user’s real browser. The vulnerability affects the @n8n/mcp-browser package when running in HTTP transport mode, exposing browser-control endpoints without any authentication.
When the n8n AI Browser Bridge extension is installed and a browser connection is active, an unauthenticated attacker can invoke browser-control tools including navigation, JavaScript execution, and access to cookies and local storage against the victim’s actual browser profile. This enables credential theft, session hijacking, and arbitrary code execution within the context of the user’s authenticated sessions across any web application.
The vulnerability was disclosed on June 23, 2026 and affects n8n versions prior to 2.25.7 and 2.26.2. The default stdio transport is not affected — only instances explicitly configured with --transport http are vulnerable. Patches are available in versions 2.25.7 and 2.26.2.
Source
GitHub Advisory (GHSA-qrx8-25qr-5r7v) · VulDB
Commentary
This vulnerability is a textbook example of why the rush to bolt MCP onto everything is creating new attack surface faster than the industry can secure it. The MCP protocol was designed for controlled tool invocation between AI agents and local services, but exposing browser-control endpoints over HTTP without authentication turns it into a remote access trojan with a standards-compliant API.
From a red team perspective, this is a juicy target: compromise one n8n instance running HTTP transport and you can hijack every browser session of the connected user — their email, cloud consoles, internal tools, everything. The attack also works via any website the user visits, making it exploitable through a simple watering-hole or phishing page. If you’re running n8n with MCP browser integrations, patch immediately and audit whether you actually need HTTP transport in the first place.