n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens from the Authorization header, per-tenant API keys from the, x-n8n-key header in multi-tenant setups, JSON-RPC request payloads sent to the MCP endpoint. Access control itself was not bypassed — unauthenticated requests were correctly rejected with 401 Unauthorized — but sensitive values from those rejected requests could still be persisted in logs. This issue has been patched in version 2.47.11.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| czlonkowski | n8n-mcp | before 2.47.11 | 2.47.11 | Patch available | CNA |
| — | n8n-mcp (npm) | before 2.47.11 | 2.47.11 | Patch available | GHSA-pfm2-2mhg-8wpx |
- n8n-mcp Vendorczlonkowski Affected before 2.47.11 Fixed in 2.47.11 Patch available CNA
- n8n-mcp (npm) Vendor— Affected before 2.47.11 Fixed in 2.47.11 Patch available GHSA-pfm2-2mhg-8wpx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:* | before 2.47.11 | Vulnerable | czlonkowski |
- cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:* Versions before 2.47.11 Vulnerable ·czlonkowski
Remediation
- Fix · CNA n8n-mcp (czlonkowski) Fixed in 2.47.11
- Fix · GHSA-pfm2-2mhg-8wpx n8n-mcp (npm) Fixed in 2.47.11 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41495
- 2026-10-03 Alias added: GHSA-pfm2-2mhg-8wpx
References
More czlonkowski N8n-mcp vulnerabilities
- TI-2026-38986 n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments CVSS 3.1CRITICAL 9.9
- TI-2026-28830 n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode CVSS 3.1HIGH 8.5
- TI-2026-30738 n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders CVSS 3.1HIGH 8.5
- TI-2026-33447 Improper access control in czlonkowski n8n-mcp CVSS 3.1HIGH 8.1
- TI-2026-32585 n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths CVSS 4.0HIGH 7.2
- TI-2026-33331 n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-41495 · CVE Program
- CVE-2026-41495 · NVD
- FIRST EPSS
- GHSA-pfm2-2mhg-8wpx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences