CVE-2026-45582

MediumCVSS 6.5/10Last modified Jul 21, 2026

Description

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.3, the workflow telemetry sanitizer could retain partial fragments of URL-shaped node parameters before sending workflow data to the project's anonymous telemetry backend. Values placed in HTTP-Request-style node parameters — such as customer or tenant identifiers, short secrets embedded in query strings, and signed request parameters — could therefore appear in stored telemetry, contrary to the collection boundary documented in PRIVACY.md. This vulnerability is fixed in 2.51.3.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-201

Affected software

VendorProductVersions
czlonkowskin8n-mcp< 2.51.3

References

Timeline

Published
May 29, 2026
Last modified
Jul 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-455838.1Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over CVE-2026-455848.1Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.CVE-2026-455856.8Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as &quot;YellowKey&quot;. The proof of conceptCVE-2026-455867.8Improper link resolution before file access ('link following') in Windows Collaborative Translation Framework allows an authorized attacker CVE-2026-455887.9Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-45596.4The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribuCVE-2026-455917.5Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-455927.8Integer overflow or wraparound in Windows Internet (wininet.dll) allows an authorized attacker to elevate privileges locally.CVE-2026-455937.8Use after free in Windows SDK allows an authorized attacker to elevate privileges locally.CVE-2026-455945.5Exposure of sensitive information to an unauthorized actor in Windows Application Identity (AppID) Subsystem allows an authorized attacker tCVE-2026-455955.4Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-455967.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-45582: Medium severity, CVSS 6.5 | Vulnix