The n8n-mcp adapter sanitized some API requests but still serialized nested credential fields, JSON strings and certain malformed arguments into telemetry or error logs. The relevant execution must enable affected telemetry or logging paths and process tool inputs containing secret or personal fields. Synthetic secret markers could pass into telemetry…
Inspect the ClaimsCase · DiggingBeagle record
n8n-mcp redaction missed nested credentials in telemetry and logs
The n8n-mcp adapter sanitized some API requests but still serialized nested credential fields, JSON strings and certain malformed arguments into telemetry or error logs. Synthetic secret markers could pass into telemetry attributes or raw log prefixes where operators or processors might later read them.
Scope
The relevant execution must enable affected telemetry or logging paths and process tool inputs containing secret or personal fields. No downstream credential abuse was demonstrated; the affected component is the third-party n8n-mcp adapter rather than the n8n core server.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: Telemetry redaction is a recursive data-flow problem, not a word filter.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-N8NMCP-TELEMETRY-SECRETS-1 · CLM-ENRICH-20261029-27 · n8n-mcp telemetry sanitizer credential exposure advisory
At a glance
Synthetic secret markers could pass into telemetry attributes or raw log prefixes where operators or processors might later read them.
Read the implicationsNo downstream credential abuse was demonstrated; the affected component is the third-party n8n-mcp adapter rather than the n8n core server.
Limits and uncertaintyFull account
The n8n-mcp adapter sanitized some API requests but still serialized nested credential fields, JSON strings and certain malformed arguments into telemetry or error logs.
The relevant execution must enable affected telemetry or logging paths and process tool inputs containing secret or personal fields. Synthetic secret markers could pass into telemetry attributes or raw log prefixes where operators or processors might later read them.
No downstream credential abuse was demonstrated; the affected component is the third-party n8n-mcp adapter rather than the n8n core server. Use n8n-mcp 2.99.0 or later, scan historical log and telemetry sinks for live keys and redact nested values at the serialization boundary.
Evidence interpretation and control boundary. Telemetry redaction is a recursive data-flow problem, not a word filter. The affected adapter could miss secrets nested inside JSON strings, alternative key fields and workflow names, and separately log malformed inputs before safe normalization. A source patch prevents future emissions but cannot prove historical telemetry was never received or that every reported token was used maliciously.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-27The n8n-mcp telemetry advisory reproduces credentials or personal details reaching anonymous event attributes or server logs when nested or malformed tool inputs bypassed sanitization.supported
Basis: reported finding
- supportsn8n-mcp telemetry sanitizer credential exposure advisoryprimary disclosure
GHSA-rqgx-cvr7-hc6x: telemetry sanitizer bypass, nested structured strings and patched release
CLM-CP23-N8NMCP-TELEMETRY-SECRETS-1The n8n-mcp adapter sanitized some API requests but still serialized nested credential fields, JSON strings and certain malformed arguments into telemetry or error logs. The relevant execution must enable affected telemetry or logging paths and process tool inputs containing secret or personal fields. Synthetic secret markers could pass into telemetry attributes or raw log prefixes where operators or processors might later read them.supported
Basis: reported finding
- supportsn8n-mcp telemetry sanitizer credential exposure advisoryprimary disclosure
GHSA-rqgx-cvr7-hc6x: telemetry sanitizer bypass, nested structured strings and patched release
Implications
Synthetic secret markers could pass into telemetry attributes or raw log prefixes where operators or processors might later read them.
Controls and mitigations
- Use n8n-mcp 2.99.0 or later, scan historical log and telemetry sinks for live keys and redact nested values at the serialization boundary.
Unknowns and contradictions
- No downstream credential abuse was demonstrated; the affected component is the third-party n8n-mcp adapter rather than the n8n core server.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202