5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41495

CVE-2026-41495: n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens from the Authorization header, per-tenant API keys from the, x-n8n-key header in multi-tenant setups, JSON-RPC request payloads sent to the MCP endpoint. Access control itself was not bypassed — unauthenticated requests were correctly rejected with 401 Unauthorized — but sensitive values from those rejected requests could still be persisted in logs. This issue has been patched in version 2.47.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41495

CVE-2026-41495:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n-mcp	npm	< 2.47.11	2.47.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the logging of sensitive information from incoming HTTP requests to the /mcp endpoint. The analysis of the patch between the vulnerable version 2.47.10 and the patched version 2.47.11 reveals two key locations where this logging occurred.

First, and most critically, within the SingleSessionHTTPServer.start method, the route handler for POST /mcp logged the full request details, including headers and body content, before any authentication checks were performed. This is the root cause of the vulnerability described in the advisory, as it allows an unauthenticated attacker to have their sensitive data (e.g., attempted Authorization headers) logged. The patch completely removes this pre-authentication logging block.

Second, the SingleSessionHTTPServer.handleRequest method, which is called for authenticated requests, also logged the full request body. The patch mitigates this by replacing the direct logging of the body with a call to a new summarizeMcpBody function. This function creates a safe summary of the request body, excluding any sensitive parameters.

Additionally, a new redactHeaders function was introduced and used to scrub sensitive headers like Authorization and x-n8n-key from the logs for authenticated requests.

The vulnerable functions are therefore the anonymous route handler defined in SingleSessionHTTPServer.start and the SingleSessionHTTPServer.handleRequest method, as they were responsible for the insecure logging.

Vulnerable functions

SingleSessionHTTPServer.start

src/http-server-single-session.ts

The `start` method configures the Express.js server and registers route handlers. The handler for `POST /mcp` was logging detailed request information, including headers and body, before performing authentication. This resulted in sensitive data such as authorization tokens and API keys from unauthenticated requests being written to the log files.

SingleSessionHTTPServer.handleRequest

src/http-server-single-session.ts

The `handleRequest` method, which processes authenticated MCP requests, was also logging the full request body. While this occurs after authentication, it still represents a risk of logging sensitive payload data. The patch replaces the full body log with a summarized and redacted version.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.