Executive brief
n8n-MCP is a server that helps AI assistants interact with n8n automation workflows. A security flaw in the way it handles usage data (telemetry) meant that sensitive information, such as customer IDs, tenant names, and short security tokens, could be accidentally sent to the project's data collection backend. This could lead to the exposure of private configuration details or credentials to the software maintainers, contrary to the project's privacy policies.
Technical details
A vulnerability in the WorkflowSanitizer component of n8n-MCP allowed sensitive data to be included in telemetry sent to the project's Supabase backend. The sanitizer previously only replaced the hostname of 'url', 'endpoint', and 'webhook' fields with a generic placeholder, leaving the path and query strings intact. This resulted in the leakage of customer/tenant identifiers, signed request parameters, and short tokens (under 20 characters) that bypassed generic redaction logic. The issue was addressed in version 2.51.3 by implementing full redaction of these fields to '[REDACTED_URL]' and hardening the node schema validation.
Affected products
- czlonkowski n8n-mcp < 2.51.3
Timeline
- 2026-05-11: patched: Fix committed and version 2.51.3 released.
- 2026-05-29: disclosed: Advisory published.