8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45707

CVE-2026-45707: n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.2, when ENABLE_MULTI_TENANT=true, the HTTP transport documents that the target n8n instance is selected per-request from x-n8n-url / x-n8n-key headers. Requests that omitted those headers — or supplied only one of them — silently fell back to the process-level N8N_API_URL / N8N_API_KEY credentials configured for the operator's own n8n instance. As a result, an authenticated MCP tenant could cause n8n management calls to execute against the operator's instance instead of its own. This affects HTTP-mode deployments of n8n-mcp that are run as a shared multi-tenant service. Single-tenant deployments (ENABLE_MULTI_TENANT unset or false) are not affected. This vulnerability is fixed in 2.51.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45707

CVE-2026-45707:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n-mcp	npm	<= 2.51.1	2.51.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-jxx9-px88-pj69, is an improper access control issue within the n8n-mcp package affecting multi-tenant deployments. The root cause is the system's failure to enforce the presence of tenant-specific headers (x-n8n-url, x-n8n-key) on incoming requests when multi-tenancy is enabled. When these headers are omitted, the application would silently and improperly fall back to using the operator's high-privilege credentials configured at the process level (i.e., from environment variables N8N_API_URL and N8N_API_KEY).

This flaw allows an authenticated tenant to escalate their privileges to that of the operator. By sending a request without the tenant headers, an attacker could trigger the getN8nApiClient function to generate an API client using the operator's credentials. This would grant the attacker the ability to read and write sensitive data, including workflows, executions, and credentials, on the operator's n8n instance, potentially leading to remote code execution.

The patch addresses this vulnerability by implementing a "fail-closed" approach. Firstly, the HTTP request handler in SingleSessionHTTPServer now explicitly rejects any request in multi-tenant mode that lacks the required headers, returning an HTTP 400 error. Secondly, the getN8nApiClient function was modified to refuse to fall back to environment credentials when in multi-tenant mode. Additional fixes were implemented in several other handlers (handleHealthCheck, handleDiagnostic, etc.) to prevent the operator's configuration details from being leaked in responses to tenants.

Vulnerable functions

getN8nApiClient

src/mcp/handlers-n8n-manager.ts

This function is responsible for creating an n8n API client. Before the patch, when operating in multi-tenant mode (`ENABLE_MULTI_TENANT=true`), if the function was called without a tenant-specific context (e.g., because the incoming request missed the required headers), it would incorrectly fall back to creating a client using the operator's credentials stored in process-level environment variables (`N8N_API_URL`, `N8N_API_KEY`). This allowed an authenticated tenant to gain privileged access to the operator's n8n instance.

SingleSessionHTTPServer.mcp_handler

src/http-server-single-session.ts

This function represents the request handler for the `/mcp` endpoint. It serves as the entry point for the vulnerability. The original code lacked a check to ensure that requests in a multi-tenant environment contained the necessary `x-n8n-url` and `x-n8n-key` headers. This omission allowed a request without these headers to be processed, which subsequently led to `getN8nApiClient` being called without a context, triggering the credential fallback vulnerability.

BaseTriggerHandler.getBaseUrl

src/triggers/handlers/base-handler.ts

This method, used by trigger handlers, was vulnerable to information disclosure. In a multi-tenant environment, if a handler was instantiated without a tenant context, this method would fall back to the operator's n8n instance URL from the environment variables. This could leak the operator's instance URL in responses or logs generated by the trigger.

BaseTriggerHandler.getApiKey

src/triggers/handlers/base-handler.ts

Similar to `getBaseUrl`, this method could cause a security issue by falling back to the operator's API key from the environment variables when a trigger handler was used without a tenant context in a multi-tenant setup. This could lead to the handler making API calls with the operator's privileges.

handleHealthCheck

src/mcp/handlers-n8n-manager.ts

This handler function was vulnerable to information disclosure. It directly used `getN8nApiConfig()` to retrieve the API URL, which fetches from environment variables. In a multi-tenant scenario, this would cause the operator's API URL to be leaked in the health check response provided to a tenant.

handleDiagnostic

src/mcp/handlers-n8n-manager.ts

This handler function was vulnerable to information disclosure. It included the operator's `N8N_API_URL` and an indicator for the `N8N_API_KEY` in the diagnostic report returned to a tenant, as it read these values directly from the environment.

handleDeployTemplate

src/mcp/handlers-n8n-manager.ts

This function was vulnerable to information disclosure. It could fall back to using the operator's API configuration from the environment, potentially leaking the operator's instance URL in the response when generating workflow links after a template deployment.

handleAuditInstance

src/mcp/handlers-n8n-manager.ts

This function was vulnerable to information disclosure. When generating an audit report, it could fall back to the operator's API configuration, causing the operator's instance URL to be included in the report sent to a tenant.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.