CVE-2026-42282: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42282 is a sensitive information disclosure vulnerability in n8n-MCP (an MCP server providing AI assistants access to n8n workflow automation) classified as "Insertion of Sensitive Information into Log File" (CWE-532). When running in HTTP transport mode, authenticated MCP tools/call requests have their full arguments and JSON-RPC parameters written to server logs before any redaction is applied, potentially exposing bearer tokens, OAuth credentials, API keys, and webhook authentication headers. All versions prior to 2.47.13 are affected; the stdio transport mode is not impacted. The vulnerability was published on May 8, 2026, and patched in version 2.47.13 released April 20, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-532: the request dispatcher and several sibling code paths in the HTTP transport mode log the full arguments of MCP tools/call requests — including the n8n_manage_credentials.data field — before any redaction logic is applied (GitHub Advisory). Although an existing console-silencing layer in HTTP mode partially reduces runtime exposure, it is described as fragile, and credential values are still constructed and passed into the logger. The fix introduced a summarizeToolCallArgs utility that records only metadata (type, top-level key names, approximate size) — never values — mirroring a pattern previously applied to HTTP request body logging (GitHub Commit). Exploitation requires a valid AUTH_TOKEN, so unauthenticated callers cannot trigger the exposure.

Successful exploitation results in disclosure of sensitive credential material persisted in server logs, including bearer tokens, OAuth credentials, per-tenant API keys, webhook authentication headers, and arbitrary secret-bearing payloads passed to any MCP tool (GitHub Advisory). The risk is amplified in deployments where logs are forwarded to external systems such as SIEM pipelines, shared log storage, or are accessible to support and operations personnel outside the request trust boundary. There is no integrity or availability impact; the confidentiality impact is rated Low in scope, but the nature of the exposed data (credentials) can enable further account compromise or lateral movement within connected n8n workflows.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires authentication (a valid AUTH_TOKEN) to trigger, limiting the attack surface to authorized users or those who have obtained valid credentials. The EPSS score is 0.057% (0.000570), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was reported by researcher @Mirr2 (Organization / Jormungandr) (GitHub Advisory).

1. Obtain authentication credentials: Acquire a valid AUTH_TOKEN for the target n8n-MCP instance running in HTTP transport mode (MCP_MODE=http), either through legitimate access, credential theft, or social engineering.
2. Identify the target endpoint: Locate the n8n-MCP HTTP server endpoint (default port 3000) and confirm it is running a version ≤ 2.47.12.
3. Send a credential-bearing MCP tool call: Issue an authenticated JSON-RPC tools/call request to the server, including sensitive credential material in the tool arguments — for example, calling n8n_manage_credentials with bearer tokens or API keys in the data field.
4. Access server logs: Gain access to the server logs (e.g., via shared log storage, SIEM pipeline access, support/ops access, or a misconfigured log viewer) where the full, unredacted tool-call arguments have been persisted.
5. Extract credentials: Parse the log entries to retrieve plaintext bearer tokens, OAuth credentials, API keys, or webhook authentication headers for use in further attacks (GitHub Advisory).

• Logs: Server log entries containing full JSON-RPC tools/call request bodies with credential fields such as n8n_manage_credentials.data, bearer tokens, or API keys in plaintext (present in versions ≤ 2.47.12 running in HTTP mode).
• Logs: Unexpected or unauthorized access to application log files, SIEM pipelines, or log storage systems around the time of MCP tool calls.
• Network: Authenticated HTTP POST requests to the n8n-MCP server (default port 3000) from unexpected source IPs or at unusual times, particularly targeting MCP tools/call endpoints.
• File System: Log files with unusually large entries or entries containing structured JSON with credential-like fields (e.g., bearer, token, apiKey, webhookAuth) in the n8n-MCP application log directory (GitHub Advisory).

Upgrade n8n-MCP to version 2.47.13 or later, available via npx n8n-mcp@latest (npm) or docker pull ghcr.io/czlonkowski/n8n-mcp:latest (Docker) (GitHub Release). If immediate upgrade is not possible, apply the following workarounds: (1) switch to stdio transport (MCP_MODE=stdio, the default for CLI invocation), which short-circuits the affected log calls; (2) restrict HTTP port access via firewall, reverse proxy, or VPN to trusted clients only; (3) restrict access to server logs to prevent unauthorized viewing. Additionally, review and redact any logs from versions prior to 2.47.13 that may contain exposed credentials, and consider rotating any credentials that may have been logged (GitHub Advisory).

The vulnerability was reported by researcher @Mirr2 from Organization / Jormungandr and acknowledged by the maintainer Romuald Członkowski (GitHub Advisory). The fix was noted to follow the same redaction pattern previously applied to HTTP request body logging (GHSA-pfm2-2mhg-8wpx), indicating a systematic approach to log security in the project. Community discussion was limited, with brief mentions on Bluesky and vulnerability tracking platforms shortly after disclosure (Feedly).