CVE-2026-45582

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Insertion of Sensitive Information Into Sent Data pada n8n-mcp. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.3, the workflow telemetry sanitizer could retain partial fragments of URL-shaped node parameters before sending workflow data to the project's anonymous telemetry backend. Values placed in HTTP-Request-style node parameters — such as customer or tenant identifiers, short secrets embedded in query strings, and signed request parameters — could therefore appear in stored telemetry, contrary to the collection boundary documented in PRIVACY.md. This vulnerability is fixed in 2.51.3.

Rincian

Terbit di NVD

29 Mei 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-f3rg-xqjj-cj9w mitigasi · advisory vendor
• https://github.com/czlonkowski/n8n-mcp/commit/6cf6fef653fcd6d598f2f356aac4754931c7329f patch
• https://github.com/czlonkowski/n8n-mcp/pull/782 issue tracking · patch
• https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.51.3 product · release notes