Telemetry Data Exposure in n8n-MCP Server from czlonkowski

CVE-2026-45582

What is CVE-2026-45582?

The n8n-MCP server, designed for AI assistants, was affected by a notable issue prior to version 2.51.3, where the workflow telemetry sanitizer could inadvertently retain segments of URL-shaped node parameters. This flaw allowed sensitive information, including customer identifiers and short secrets, to be captured and stored in the telemetry database, raising significant privacy concerns. This problem has been addressed in version 2.51.3, ensuring the proper handling of sensitive data in compliance with the documented privacy boundaries.

References