The separate n8n-mcp legacy HTTP server treated its publicly documented placeholder AUTH_TOKEN as an acceptable production credential. The legacy HTTP mode had to be enabled, including configurations sourcing the placeholder from a token file; deployments with a real secret were not inherently affected. A client knowing the default token could invoke…
Inspect the ClaimsCase · DiggingBeagle record
n8n-mcp legacy HTTP accepted a documented placeholder bearer secret
The separate n8n-mcp legacy HTTP server treated its publicly documented placeholder AUTH_TOKEN as an acceptable production credential. A client knowing the default token could invoke exposed MCP server operations if the HTTP endpoint was reachable.
Scope
The legacy HTTP mode had to be enabled, including configurations sourcing the placeholder from a token file; deployments with a real secret were not inherently affected. No mass compromise or exposed-host census was supplied, and this issue should not be conflated with the newer n8n-mcp HTTP implementation.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: A default credential string ceases to be a secret once it appears in public configuration documentation.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-N8NMCP-PLACEHOLDER-TOKEN-1 · CLM-ENRICH-20261029-24 · n8n-mcp legacy server placeholder token advisory
At a glance
A client knowing the default token could invoke exposed MCP server operations if the HTTP endpoint was reachable.
Read the implicationsNo mass compromise or exposed-host census was supplied, and this issue should not be conflated with the newer n8n-mcp HTTP implementation.
Limits and uncertaintyFull account
The separate n8n-mcp legacy HTTP server treated its publicly documented placeholder AUTH_TOKEN as an acceptable production credential.
The legacy HTTP mode had to be enabled, including configurations sourcing the placeholder from a token file; deployments with a real secret were not inherently affected. A client knowing the default token could invoke exposed MCP server operations if the HTTP endpoint was reachable.
No mass compromise or exposed-host census was supplied, and this issue should not be conflated with the newer n8n-mcp HTTP implementation. Upgrade n8n-mcp to 2.99.0 or later and fail closed at startup for empty, default or placeholder authentication values.
Evidence interpretation and control boundary. A default credential string ceases to be a secret once it appears in public configuration documentation. The affected adapter’s legacy HTTP server accepted that placeholder as a bearer token in some deployment modes, including file-based secret injection. This is not a weakness in the separate core n8n application. Safe startup must reject placeholder values both from direct variables and secret files.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-24The n8n-mcp advisory identifies a legacy HTTP authentication configuration accepting a documented placeholder AUTH_TOKEN, rather than failing closed on an insecure startup configuration.supported
Basis: reported finding
- supportsn8n-mcp legacy server placeholder token advisoryprimary disclosure
GHSA-7mg3-m9wx-m555: USE_FIXED_HTTP, AUTH_TOKEN_FILE and fixed release
CLM-CP23-N8NMCP-PLACEHOLDER-TOKEN-1The separate n8n-mcp legacy HTTP server treated its publicly documented placeholder AUTH_TOKEN as an acceptable production credential. The legacy HTTP mode had to be enabled, including configurations sourcing the placeholder from a token file; deployments with a real secret were not inherently affected. A client knowing the default token could invoke exposed MCP server operations if the HTTP endpoint was reachable.supported
Basis: reported finding
- supportsn8n-mcp legacy server placeholder token advisoryprimary disclosure
GHSA-7mg3-m9wx-m555: USE_FIXED_HTTP, AUTH_TOKEN_FILE and fixed release
Implications
A client knowing the default token could invoke exposed MCP server operations if the HTTP endpoint was reachable.
Controls and mitigations
- Upgrade n8n-mcp to 2.99.0 or later and fail closed at startup for empty, default or placeholder authentication values.
Unknowns and contradictions
- No mass compromise or exposed-host census was supplied, and this issue should not be conflated with the newer n8n-mcp HTTP implementation.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202