{"data":{"id":"4dbdfcd8-24c4-4461-adfe-8326cbd35ef4","title":"GHSA-jxx9-px88-pj69: n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete","summary":"When ENABLE_MULTI_TENANT=true, n8n-mcp's HTTP transport selects the target n8n instance from the x-n8n-url and x-n8n-key headers, but requests missing one or both headers silently fell back to the operator's process-level N8N_API_URL and N8N_API_KEY. An authenticated MCP tenant could therefore run n8n management calls against the operator's own instance, with possible escalation to remote code execution where Code-node execution reaches OS-level modules. Single-tenant deployments are not affected.","solution":"Fixed in n8n-mcp 2.51.2, which rejects header-less multi-tenant requests with HTTP 400 / JSON-RPC -32602 and refuses to construct an env-credential n8n API client when ENABLE_MULTI_TENANT=true. Upgrade with `npx n8n-mcp@latest` or `docker pull ghcr.io/czlonkowski/n8n-mcp:latest`. Workarounds: set ENABLE_MULTI_TENANT=false and run a separate instance per tenant with its own credentials; require both x-n8n-url and x-n8n-key at a proxy (partial mitigation only); or scope the operator's N8N_API_KEY to the minimum required permissions.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-jxx9-px88-pj69","publishedAt":"2026-05-18T17:41:42.000Z","cveId":"CVE-2026-45707","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n-mcp@<= 2.51.1 (fixed: 2.51.2)"],"affectedPackageNames":["n8n-mcp"],"affectedPackageRefs":["npm:n8n-mcp"],"affectedVendors":[],"affectedVendorsRaw":["n8n-MCP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00413,"epssCheckedAt":"2026-10-14T06:09:07.174Z","kevDateAdded":null,"advisoryAliases":["GHSA-jxx9-px88-pj69"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-18T17:41:42.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}