{"data":{"id":"7aa9c7c9-c63b-4ad7-aec2-54c0208a9e19","title":"GHSA-pfm2-2mhg-8wpx: n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests","summary":"n8n-mcp (a tool that connects n8n automation software to external services) was logging sensitive information like bearer tokens and API keys when it received unauthorized requests to its HTTP endpoint, even though it correctly rejected those requests. This happened because the logs captured request metadata before checking authentication, which could expose secrets if logs were shared or stored outside secure boundaries.","solution":"Upgrade to n8n-mcp v2.47.11 or later using 'npx n8n-mcp@latest' for npm or 'docker pull ghcr.io/czlonkowski/n8n-mcp:latest' for Docker. If immediate upgrade is not possible, restrict network access to the HTTP port using a firewall or reverse proxy, or switch to stdio transport mode by setting MCP_MODE=stdio.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-pfm2-2mhg-8wpx","publishedAt":"2026-04-23T14:31:46.000Z","cveId":"CVE-2026-41495","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["pii_leakage"],"issueType":"vulnerability","affectedPackages":["n8n-mcp@< 2.47.11 (fixed: 2.47.11)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["n8n-MCP","n8n"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-04-23T14:31:46.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}