Understanding the n8n-MCP Information Leak
n8n-MCP is a server designed to help AI assistants access documentation, properties, and operations for n8n nodes. Recently, a vulnerability was discovered in older versions of n8n-MCP that could unintentionally expose sensitive information.
Before version 2.51.3, the system responsible for sanitizing workflow data before sending it to the project’s anonymous telemetry backend had a flaw. This flaw meant that parts of URLs, specifically the path and query string sections, were not properly removed. As a result, sensitive data like customer or tenant identifiers, short secrets found in query strings, and signed request parameters could inadvertently be included in the stored telemetry data. This was contrary to the privacy policies that were supposed to prevent such collection.
CVE Details
- Product: n8n-MCP
- Published Date: May 29, 2026
- Severity: Medium (CVSS Score: 6.5)
- Status: Analyzed
Affected Products
This information disclosure vulnerability affects all versions of n8n-MCP prior to 2.51.3. If you are running an older version, your system might be at risk of inadvertently logging sensitive data.
Current Status
The vulnerability, identified as CVE-2026-45582, has been thoroughly analyzed. Developers have acknowledged the issue and have released a patch to address it, ensuring that sensitive URL components are properly redacted before telemetry data is transmitted.
Severity Level
The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 6.5, classifying it as ‘Medium’ severity. While not allowing direct control over the system, successful exploitation could lead to unauthorized disclosure of potentially sensitive user or system data through telemetry logs. This could have privacy implications and potentially be misused if intercepted.
Possible Solutions
The good news is that a fix is readily available. To protect your n8n-MCP installation from this information disclosure vulnerability, it is crucial to update to version 2.51.3 or later as soon as possible.
The fix implemented in version 2.51.3 ensures that:
- A component called `sanitizeObject` now completely redacts URL-named fields, changing their values to `[REDACTED_URL]` to prevent any part of the URL from leaking.
- Previous logic that only hid the hostname in `sanitizeString` has been removed, ensuring a more comprehensive redaction.
- Additional defense-in-depth measures have been added to `event-validator.ts` by using a strict schema for nodes, which rejects any unexpected top-level keys in node data, further preventing unintended data exposure.
By upgrading, you ensure that your workflow telemetry is sanitized correctly, adhering to privacy standards and protecting sensitive information.
References
https://github.com/czlonkowski/n8n-mcp/commit/6cf6fef653fcd6d598f2f356aac4754931c7329f
https://github.com/czlonkowski/n8n-mcp/pull/782
https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.51.3
https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-f3rg-xqjj-cj9w
