CVE-2026-45707-nvd.nist.gov-Received

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.2, when ENABLE_MULTI_TENANT=tru…

Published:

28 May 2026 at 22:00:00

Alert date:

29 May 2026 at 15:02:48

Source:

nvd.nist.gov

Web Technologies, Identity & Access

CVE-2026-45707 affects n8n-MCP server prior to version 2.51.2 in multi-tenant deployments. When ENABLE_MULTI_TENANT=true, requests missing x-n8n-url or x-n8n-key headers fall back to operator credentials. This allows authenticated tenants to execute management calls against the operator's n8n instance instead of their own. The vulnerability only affects HTTP-mode multi-tenant deployments and is fixed in version 2.51.2.

Technical details

Mitigation steps:

Affected products:

n8n-MCP