GHSA-pfm2-2mhg-8wpx: n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
- Identifiers
- CVE-2026-41495GHSA-pfm2-2mhg-8wpx
- Published
- Record updated
- Affected
- n8n-mcp < 2.47.11
- Fixed in
- 2.47.11
- released April 16, 2026, 7 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
Versions 2.47.10 and earlier of n8n-mcp, when run in HTTP transport mode, wrote request metadata for incoming POST /mcp requests to server logs even when authentication failed. Sensitive values from those rejected requests, including bearer tokens from the Authorization header, per-tenant x-n8n-key API keys, and JSON-RPC payloads, could therefore be persisted and exposed to anyone with access to collected logs. Access control itself was not bypassed, since unauthenticated requests received 401 Unauthorized, and the stdio transport is not affected.
Mitigation
Fixed in v2.47.11 (npm: npx n8n-mcp@latest or >= 2.47.11; Docker: ghcr.io/czlonkowski/n8n-mcp:latest). Workarounds: restrict network access to the HTTP port with a firewall, reverse proxy, or VPN, or switch to stdio transport (MCP_MODE=stdio).
Topics
Related items
- HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
- HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
- MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News