Executive brief
n8n-mcp is a server that allows AI assistants to interact with n8n automation tools. A security flaw in versions prior to 2.47.11 causes the server to record sensitive information, such as API keys and login tokens, into system logs even if a login attempt fails. If these logs are shared with other systems or accessible by unauthorized staff, it could lead to the theft of credentials and unauthorized access to automation workflows.
Technical details
n8n-mcp prior to version 2.47.11 is vulnerable to sensitive information disclosure via log files (CWE-532). When running in HTTP transport mode, the server logs request metadata for all incoming POST requests to the /mcp endpoint, including those that fail authentication with a 401 Unauthorized status. This logging includes sensitive headers such as 'Authorization' (bearer tokens) and 'x-n8n-key' (API keys), as well as JSON-RPC request payloads. An attacker can intentionally send requests containing sensitive data to populate logs that may be accessible via shared storage, SIEM pipelines, or monitoring tools. The issue is patched in version 2.47.11; users can also mitigate the risk by switching to stdio transport mode.
Affected products
- czlonkowski n8n-mcp <= 2.47.10
Timeline
- 2026-04-16: patched: Version 2.47.11 released
- 2026-04-20: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD