Vulnerability-Lookup

CVE-2026-41495 (GCVE-0-2026-41495)

Vulnerability from cvelistv5 – Published: 2026-05-08 18:58 – Updated: 2026-05-13 17:47

Title

n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

Summary

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens from the Authorization header, per-tenant API keys from the, x-n8n-key header in multi-tenant setups, JSON-RPC request payloads sent to the MCP endpoint. Access control itself was not bypassed — unauthenticated requests were correctly rejected with 401 Unauthorized — but sensitive values from those rejected requests could still be persisted in logs. This issue has been patched in version 2.47.11.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 17:17 UTC

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/czlonkowski/n8n-mcp/security/a…	x_refsource_CONFIRM
https://github.com/czlonkowski/n8n-mcp/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
czlonkowski	n8n-mcp	Affected: < 2.47.11	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41495",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T17:17:26.422382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T17:47:45.506Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n8n-mcp",
          "vendor": "czlonkowski",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.47.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens from the Authorization header, per-tenant API keys from the, x-n8n-key header in multi-tenant setups, JSON-RPC request payloads sent to the MCP endpoint. Access control itself was not bypassed \u2014 unauthenticated requests were correctly rejected with 401 Unauthorized \u2014 but sensitive values from those rejected requests could still be persisted in logs. This issue has been patched in version 2.47.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T18:58:24.574Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-pfm2-2mhg-8wpx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-pfm2-2mhg-8wpx"
        },
        {
          "name": "https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.11"
        }
      ],
      "source": {
        "advisory": "GHSA-pfm2-2mhg-8wpx",
        "discovery": "UNKNOWN"
      },
      "title": "n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41495",
    "datePublished": "2026-05-08T18:58:24.574Z",
    "dateReserved": "2026-04-20T16:14:19.009Z",
    "dateUpdated": "2026-05-13T17:47:45.506Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-41495",
      "date": "2026-11-11",
      "epss": "0.00255",
      "percentile": "0.17231"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "n8n-mcp",
                "vendor": "czlonkowski",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.47.11"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BACF38A0-0100-4102-BE5A-43C672B654AE",
                    "versionEndExcluding": "2.47.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens from the Authorization header, per-tenant API keys from the, x-n8n-key header in multi-tenant setups, JSON-RPC request payloads sent to the MCP endpoint. Access control itself was not bypassed \u2014 unauthenticated requests were correctly rejected with 401 Unauthorized \u2014 but sensitive values from those rejected requests could still be persisted in logs. This issue has been patched in version 2.47.11."
          },
          {
            "lang": "es",
            "value": "n8n-MCP es un servidor MCP que proporciona a los asistentes de IA acceso a la documentaci\u00f3n, propiedades y operaciones de los nodos n8n. Antes de la versi\u00f3n 2.47.11, cuando n8n-mcp se ejecuta en modo de transporte HTTP, las solicitudes entrantes al endpoint POST /mcp ten\u00edan sus metadatos de solicitud escritos en los registros del servidor independientemente del resultado de la autenticaci\u00f3n. En implementaciones donde los registros se recopilan, se reenv\u00edan a sistemas externos o son visibles fuera del l\u00edmite de confianza de la solicitud (almacenamiento de registros compartido, pipelines SIEM, acceso de soporte/operaciones), esto puede resultar en la divulgaci\u00f3n de: tokens de portador del encabezado de autorizaci\u00f3n, claves API por inquilino del encabezado x-n8n-key en configuraciones multi-inquilino, cargas \u00fatiles de solicitud JSON-RPC enviadas al endpoint MCP. El control de acceso en s\u00ed mismo no fue eludido - las solicitudes no autenticadas fueron correctamente rechazadas con 401 No autorizado - pero los valores sensibles de esas solicitudes rechazadas a\u00fan pod\u00edan persistir en los registros. Este problema ha sido parcheado en la versi\u00f3n 2.47.11."
          }
        ],
        "id": "CVE-2026-41495",
        "lastModified": "2026-10-26T18:10:00.173",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-41495",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T17:17:26.422382Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-08T20:16:30.323",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product",
              "Release Notes"
            ],
            "url": "https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.11"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-pfm2-2mhg-8wpx"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-532"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-13T20:23:23+00:00",
      "cve": "CVE-2026-41495",
      "id": "CVE-2026-41495",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41495.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-41495",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-13T17:17:26.422382Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-13T17:47:40.795Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n8n-mcp",
              "vendor": "czlonkowski",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.47.11"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens from the Authorization header, per-tenant API keys from the, x-n8n-key header in multi-tenant setups, JSON-RPC request payloads sent to the MCP endpoint. Access control itself was not bypassed \u2014 unauthenticated requests were correctly rejected with 401 Unauthorized \u2014 but sensitive values from those rejected requests could still be persisted in logs. This issue has been patched in version 2.47.11."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-532",
                  "description": "CWE-532: Insertion of Sensitive Information into Log File",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-08T18:58:24.574Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-pfm2-2mhg-8wpx",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-pfm2-2mhg-8wpx"
            },
            {
              "name": "https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.11",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.11"
            }
          ],
          "source": {
            "advisory": "GHSA-pfm2-2mhg-8wpx",
            "discovery": "UNKNOWN"
          },
          "title": "n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-41495",
        "datePublished": "2026-05-08T18:58:24.574Z",
        "dateReserved": "2026-04-20T16:14:19.009Z",
        "dateUpdated": "2026-05-13T17:47:45.506Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BREW-N8N-MCP-CVE-2026-41495 (GHSA-PFM2-2MHG-8WPX)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:16 – Updated: 2026-11-09 10:21 – Source website

Summary

n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

Details

Impact

When n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of:

bearer tokens from the Authorization header
per-tenant API keys from the x-n8n-key header in multi-tenant setups
JSON-RPC request payloads sent to the MCP endpoint

Access control itself was not bypassed — unauthenticated requests were correctly rejected with 401 Unauthorized — but sensitive values from those rejected requests could still be persisted in logs.

Impact category: CWE-532 (Insertion of Sensitive Information into Log File).

Affected

Deployments running n8n-mcp v2.47.10 or earlier in HTTP transport mode (MCP_MODE=http). The stdio transport is not affected.

Patched

v2.47.11 and later.

npm: npx n8n-mcp@latest (or pin to >= 2.47.11)
Docker: docker pull ghcr.io/czlonkowski/n8n-mcp:latest

Workarounds

If users cannot upgrade immediately:

Restrict network access to the HTTP port (firewall, reverse proxy, or VPN) so only trusted clients can reach the endpoint.
Switch to stdio transport (MCP_MODE=stdio, the default for CLI invocation), which has no HTTP surface.

Credit

n8n-MCP thanks @S4nso (Organization / Jormungandr) for reporting this issue.

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

URL

Type

	https://github.com/czlonkowski/n8n-mcp/security/a…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-41495	ADVISORY
	https://github.com/czlonkowski/n8n-mcp	PACKAGE
	https://github.com/czlonkowski/n8n-mcp/releases/t…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "2.47.11"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "n8n-mcp",
        "purl": "pkg:brew/n8n-mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.14.1"
            },
            {
              "fixed": "2.47.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/n8n-mcp@2.101.4",
        "name": "n8n-mcp",
        "strategy": "registry",
        "subject_version": "2.101.4"
      }
    ]
  },
  "details": "### Impact\n\nWhen `n8n-mcp` runs in HTTP transport mode, incoming requests to the `POST /mcp` endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of:\n\n- bearer tokens from the `Authorization` header\n- per-tenant API keys from the `x-n8n-key` header in multi-tenant setups\n- JSON-RPC request payloads sent to the MCP endpoint\n\nAccess control itself was not bypassed \u2014 unauthenticated requests were correctly rejected with `401 Unauthorized` \u2014 but sensitive values from those rejected requests could still be persisted in logs.\n\nImpact category: **CWE-532** (Insertion of Sensitive Information into Log File).\n\n### Affected\n\nDeployments running n8n-mcp **v2.47.10 or earlier** in HTTP transport mode (`MCP_MODE=http`). The stdio transport is not affected.\n\n### Patched\n\n**v2.47.11** and later.\n\n- npm: `npx n8n-mcp@latest` (or pin to `\u003e= 2.47.11`)\n- Docker: `docker pull ghcr.io/czlonkowski/n8n-mcp:latest`\n\n### Workarounds\n\nIf users cannot upgrade immediately:\n\n- Restrict network access to the HTTP port (firewall, reverse proxy, or VPN) so only trusted clients can reach the endpoint.\n- Switch to stdio transport (`MCP_MODE=stdio`, the default for CLI invocation), which has no HTTP surface.\n\n### Credit\n\nn8n-MCP thanks [@S4nso](https://github.com/S4nso) (Organization / Jormungandr) for reporting this issue.",
  "id": "BREW-n8n-mcp-CVE-2026-41495",
  "modified": "2026-11-09T10:21:23Z",
  "published": "2026-08-13T17:16:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-pfm2-2mhg-8wpx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41495"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/czlonkowski/n8n-mcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.11"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests",
  "upstream": [
    "GHSA-pfm2-2mhg-8wpx",
    "CVE-2026-41495"
  ]
}

FKIE_CVE-2026-41495

Vulnerability from fkie_nvd - Published: 2026-05-08 20:16 - Updated: 2026-10-26 18:10

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.11	Product, Release Notes
	security-advisories@github.com	https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-pfm2-2mhg-8wpx	Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	n8n-mcp	n8n-mcp	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n8n-mcp",
          "vendor": "czlonkowski",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.47.11"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BACF38A0-0100-4102-BE5A-43C672B654AE",
              "versionEndExcluding": "2.47.11",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens from the Authorization header, per-tenant API keys from the, x-n8n-key header in multi-tenant setups, JSON-RPC request payloads sent to the MCP endpoint. Access control itself was not bypassed \u2014 unauthenticated requests were correctly rejected with 401 Unauthorized \u2014 but sensitive values from those rejected requests could still be persisted in logs. This issue has been patched in version 2.47.11."
    },
    {
      "lang": "es",
      "value": "n8n-MCP es un servidor MCP que proporciona a los asistentes de IA acceso a la documentaci\u00f3n, propiedades y operaciones de los nodos n8n. Antes de la versi\u00f3n 2.47.11, cuando n8n-mcp se ejecuta en modo de transporte HTTP, las solicitudes entrantes al endpoint POST /mcp ten\u00edan sus metadatos de solicitud escritos en los registros del servidor independientemente del resultado de la autenticaci\u00f3n. En implementaciones donde los registros se recopilan, se reenv\u00edan a sistemas externos o son visibles fuera del l\u00edmite de confianza de la solicitud (almacenamiento de registros compartido, pipelines SIEM, acceso de soporte/operaciones), esto puede resultar en la divulgaci\u00f3n de: tokens de portador del encabezado de autorizaci\u00f3n, claves API por inquilino del encabezado x-n8n-key en configuraciones multi-inquilino, cargas \u00fatiles de solicitud JSON-RPC enviadas al endpoint MCP. El control de acceso en s\u00ed mismo no fue eludido - las solicitudes no autenticadas fueron correctamente rechazadas con 401 No autorizado - pero los valores sensibles de esas solicitudes rechazadas a\u00fan pod\u00edan persistir en los registros. Este problema ha sido parcheado en la versi\u00f3n 2.47.11."
    }
  ],
  "id": "CVE-2026-41495",
  "lastModified": "2026-10-26T18:10:00.173",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41495",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-13T17:17:26.422382Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-08T20:16:30.323",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.11"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-pfm2-2mhg-8wpx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-PFM2-2MHG-8WPX

Vulnerability from github – Published: 2026-04-23 14:31 – Updated: 2026-05-13 13:33

Summary

n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

Details

Impact

bearer tokens from the Authorization header
per-tenant API keys from the x-n8n-key header in multi-tenant setups
JSON-RPC request payloads sent to the MCP endpoint

Impact category: CWE-532 (Insertion of Sensitive Information into Log File).

Affected

Deployments running n8n-mcp v2.47.10 or earlier in HTTP transport mode (MCP_MODE=http). The stdio transport is not affected.

Patched

v2.47.11 and later.

npm: npx n8n-mcp@latest (or pin to >= 2.47.11)
Docker: docker pull ghcr.io/czlonkowski/n8n-mcp:latest

Workarounds

If users cannot upgrade immediately:

Restrict network access to the HTTP port (firewall, reverse proxy, or VPN) so only trusted clients can reach the endpoint.
Switch to stdio transport (MCP_MODE=stdio, the default for CLI invocation), which has no HTTP surface.

Credit

n8n-MCP thanks @S4nso (Organization / Jormungandr) for reporting this issue.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n-mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.47.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41495"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-23T14:31:46Z",
    "nvd_published_at": "2026-05-08T20:16:30Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nWhen `n8n-mcp` runs in HTTP transport mode, incoming requests to the `POST /mcp` endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of:\n\n- bearer tokens from the `Authorization` header\n- per-tenant API keys from the `x-n8n-key` header in multi-tenant setups\n- JSON-RPC request payloads sent to the MCP endpoint\n\nAccess control itself was not bypassed \u2014 unauthenticated requests were correctly rejected with `401 Unauthorized` \u2014 but sensitive values from those rejected requests could still be persisted in logs.\n\nImpact category: **CWE-532** (Insertion of Sensitive Information into Log File).\n\n### Affected\n\nDeployments running n8n-mcp **v2.47.10 or earlier** in HTTP transport mode (`MCP_MODE=http`). The stdio transport is not affected.\n\n### Patched\n\n**v2.47.11** and later.\n\n- npm: `npx n8n-mcp@latest` (or pin to `\u003e= 2.47.11`)\n- Docker: `docker pull ghcr.io/czlonkowski/n8n-mcp:latest`\n\n### Workarounds\n\nIf users cannot upgrade immediately:\n\n- Restrict network access to the HTTP port (firewall, reverse proxy, or VPN) so only trusted clients can reach the endpoint.\n- Switch to stdio transport (`MCP_MODE=stdio`, the default for CLI invocation), which has no HTTP surface.\n\n### Credit\n\nn8n-MCP thanks [@S4nso](https://github.com/S4nso) (Organization / Jormungandr) for reporting this issue.",
  "id": "GHSA-pfm2-2mhg-8wpx",
  "modified": "2026-05-13T13:33:57Z",
  "published": "2026-04-23T14:31:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-pfm2-2mhg-8wpx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41495"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/czlonkowski/n8n-mcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.47.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-41495 (GCVE-0-2026-41495)

BREW-N8N-MCP-CVE-2026-41495 (GHSA-PFM2-2MHG-8WPX)

Impact

Affected

Patched

Workarounds

Credit

FKIE_CVE-2026-41495

GHSA-PFM2-2MHG-8WPX

Impact

Affected

Patched

Workarounds

Credit

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour