GHSA-wg4g-395p-mqv3: n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode
- Identifier
- GHSA-wg4g-395p-mqv3
- Published
- Record updated
- Affected
- n8n-mcp < 2.47.13
- Fixed in
- 2.47.13
- released April 20, 2026, 5 days before disclosure
Summary
In HTTP transport mode, n8n-mcp versions v2.47.12 and earlier wrote full MCP tools/call arguments and JSON-RPC params to server logs for authenticated requests, before redaction. When a call carried credentials, such as through n8n_manage_credentials.data, the raw values could be persisted in logs, exposing bearer tokens, OAuth credentials, API keys and webhook auth headers to anyone with access to collected or forwarded logs. The issue requires a valid AUTH_TOKEN, and the stdio transport is not affected in practice.
Mitigation
Fixed in v2.47.13 (npm: npx n8n-mcp@latest or >= 2.47.13; Docker: ghcr.io/czlonkowski/n8n-mcp:latest). Interim workarounds: restrict access to the HTTP port, restrict access to server logs, or switch to stdio transport (MCP_MODE=stdio).
Topics
Related items
- MediumCVE-2026-121938: langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated…Similar attack · NVD/CVE Database
- InfoResidual Attribute Leakage Is an Interface: Auditing Privacy Evaluation After Text De-identificationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumHundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake FeaturesSimilar attack · Wired (Security)
- MediumNew VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial ValueSimilar attack · The Hacker News
- InfoAccessed, never disclosed: Silent access to protected health information by medical artificial intelligence agentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)