CVE-2026-42282
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In n8n-MCP prior to version 2.47.13, when running in HTTP transport mode, authenticated tools/call requests had their full arguments and JSON-RPC params written to server logs before any redaction. When a tool call carries credential material (e.g., n8n_manage_credentials.data), raw values can be persisted in logs. In deployments with log collection, this can disclose bearer tokens, OAuth credentials, API keys, and other secrets. The issue requires authentication and is patched in version 2.47.13.
Risk Assessment
Credentials and secrets passed in MCP tool calls may leak through logs. This can lead to unauthorized access to n8n and connected systems.
Recommendation
Update n8n-MCP to version 2.47.13 or later. Review logs for exposed secrets and consider rotating credentials.
Other vulnerabilities in n8n-MCP
See all- CVE-2026-54052Critical
In n8n-MCP prior to version 2.56.1, in HTTP mode with multi-tenancy enabled (ENABLE_MULTI_TENANT=true), local workflow version history backups were not isolated per tenant. This allowed an authenticated tenant to read and delete backups of other tenants, including full node definitions, credential references, and authorization headers.
- CVE-2026-44694Critical
n8n-MCP, an MCP server, has an authenticated server-side request forgery vulnerability affecting webhook trigger tools and the n8n API client. This issue exists in versions from 2.18.7 to before 2.50.2 and has been patched in version 2.50.2.
- CVE-2026-55608Medium
In n8n-MCP prior to version 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations.
- CVE-2026-45707High
In n8n-MCP prior to 2.51.2, when ENABLE_MULTI_TENANT=true, HTTP requests without x-n8n-url or x-n8n-key headers silently fell back to the operator's credentials, allowing an authenticated MCP tenant to execute n8n management calls against the operator's instance instead of its own.
- CVE-2026-45582Medium
In n8n-MCP prior to 2.51.3, the workflow telemetry sanitizer could retain partial fragments of URL-shaped node parameters, such as customer identifiers or secrets in query strings, before sending data to the anonymous telemetry backend. This is fixed in version 2.51.3.
- CVE-2026-41495Medium
In n8n-MCP prior to version 2.47.11, when running in HTTP transport mode, request metadata for the POST /mcp endpoint was written to server logs regardless of authentication outcome. In deployments where logs are collected or forwarded, this can disclose bearer tokens, per-tenant API keys, and JSON-RPC payloads. Access control was not bypassed — unauthenticated requests were correctly rejected with 401 — but sensitive values could still be persisted in logs. The issue is patched in version 2.47.11.
- CVE-2026-42449High
n8n-MCP versions 2.47.4 through 2.47.13 have an incomplete URL validator in SSRFProtection.validateUrlSync() that lacks IPv6 checks. IPv4-mapped IPv6 addresses such as http://[::ffff:169.254.169.254] bypass cloud-metadata, localhost, and private-IP range checks, allowing an attacker to make the server issue requests to sensitive targets and return responses plus the x-n8n-api-key header. The issue is fixed in version 2.47.14.
Original NVD description (English source)
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.13, when n8n-mcp runs in HTTP transport mode, authenticated MCP tools/call requests had their full arguments and JSON-RPC params written to server logs by the request dispatcher and several sibling code paths before any redaction. When a tool call carries credential material — most notably n8n_manage_credentials.data — the raw values can be persisted in logs. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens and OAuth credentials sent through n8n_manage_credentials, per-tenant API keys and webhook auth headers embedded in tool arguments, arbitrary secret-bearing payloads passed to any MCP tool. The issue requires authentication (AUTH_TOKEN accepted by the server), so unauthenticated callers cannot trigger it; the runtime exposure is also reduced by an existing console-silencing layer in HTTP mode, but that layer is fragile and the values are still constructed and passed into the logger. This issue has been patched in version 2.47.13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS