n8n MCP create_workflow_from_code Cross-Project Credential Injection Vulnerability (GHSA-vfj7-582q-mvcp)

Vulnerability Overview Vulnerability Name: MCP Accepts Cross-Project Credentials When Auth Type Is an Expression Vulnerability ID: GHSA-vfj7-582q-mvcp Severity: Medium (CVSS v4 base metrics: 5.3 / 10) Release Date: October 11, 2024 Affected Versions Affected Versions: - n8n = 2.34.1 - n8n >= 2.33.4 Remediation Patch: - Upgrade to n8n versions 2.33.4 or 2.34.1. Temporary Mitigations: - Restrict access to n8n instances to trusted users only. - Disable MCP server access or revoke MCP API keys until the instance is patched. - Audit workflows created via MCP to prevent unintended cross-project credential references. Description Impact: - The MCP tool does not apply the same expression-aware guards used in runtime execution paths to validate credentials. When a node's authentication type is set to an expression rather than a literal string, the credential reference validator treats the expression as an active type, which never matches a real secret. Consequently, the cross-project ownership check is skipped, and credentials belonging to another project may be persisted in bindings within the workflow. - Exploitation requires MCP enabled on the instance, a valid MCP Bearer API key, and knowledge of the target project ID. Runtime execution paths still prevent the use of external credentials during workflow execution; therefore, no credentials are exposed, and no actual requests are made using external credentials. The impact is limited to the unauthorized persistence of workflow references across project boundaries. Workaround Temporary Mitigations: - If an immediate upgrade is not possible, administrators should consider the following temporary mitigations: - Restrict access to n8n instances to trusted users only. - Disable MCP server access or revoke MCP API keys until the instance is patched. - Audit workflows created via MCP to prevent unintended cross-project credential references. - These mitigations do not fully eliminate the risk and should only be used as short-term measures. Additional Information CVSS v4 base metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: Low - User Interaction: Low Vulnerable System Impacts: - Confidentiality: Low - Integrity: None - Availability: Low Subsequent System Impacts: - Confidentiality: None - Integrity: Low - Availability: Low CVE ID: No known CVE Weakness: No CWE Credit: vonypo (Reporter)

Goal Reached Thanks to every supporter — we hit 100%!

n8n MCP create_workflow_from_code Cross-Project Credential Injection Vulnerability (GHSA-vfj7-582q-mvcp)

More from this source