CVE-2026-45707

Katalog CVE

CVSS 8.1 · High EPSS 0,41%

Kerentanan Improper Access Control pada n8n-mcp. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.2, when ENABLE_MULTI_TENANT=true, the HTTP transport documents that the target n8n instance is selected per-request from x-n8n-url / x-n8n-key headers. Requests that omitted those headers — or supplied only one of them — silently fell back to the process-level N8N_API_URL / N8N_API_KEY credentials configured for the operator's own n8n instance. As a result, an authenticated MCP tenant could cause n8n management calls to execute against the operator's instance instead of its own. This affects HTTP-mode deployments of n8n-mcp that are run as a shared multi-tenant service. Single-tenant deployments (ENABLE_MULTI_TENANT unset or false) are not affected. This vulnerability is fixed in 2.51.2.

Rincian

Terbit di NVD

29 Mei 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-jxx9-px88-pj69 mitigasi · advisory vendor
• https://github.com/czlonkowski/n8n-mcp/commit/853015d0897be7cf2d9d4726de195c938e4395ab patch
• https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.51.2 product · release notes