Skip to content
AI Sec Watch
HighVulnerability

GHSA-jxx9-px88-pj69: n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-45707GHSA-jxx9-px88-pj69
Published
Record updated
View JSON
Affected
  • n8n-mcp <= 2.51.1
Fixed in
2.51.2
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.4%

Summary

When ENABLE_MULTI_TENANT=true, n8n-mcp's HTTP transport selects the target n8n instance from the x-n8n-url and x-n8n-key headers, but requests missing one or both headers silently fell back to the operator's process-level N8N_API_URL and N8N_API_KEY. An authenticated MCP tenant could therefore run n8n management calls against the operator's own instance, with possible escalation to remote code execution where Code-node execution reaches OS-level modules. Single-tenant deployments are not affected.

Mitigation

Fixed in n8n-mcp 2.51.2, which rejects header-less multi-tenant requests with HTTP 400 / JSON-RPC -32602 and refuses to construct an env-credential n8n API client when ENABLE_MULTI_TENANT=true. Upgrade with `npx n8n-mcp@latest` or `docker pull ghcr.io/czlonkowski/n8n-mcp:latest`. Workarounds: set ENABLE_MULTI_TENANT=false and run a separate instance per tenant with its own credentials; require both x-n8n-url and x-n8n-key at a proxy (partial mitigation only); or scope the operator's N8N_API_KEY to the minimum required permissions.

Topics

Related items