The report
The label n8n covers more than one codebase. The recent security reports about the third-party n8n-mcp adapter should not be assigned to the core n8n server without checking which package was actually installed. Four independently disclosed defects affect how that adapter receives calls, maintains state, stores backups and sends diagnostic data.
Four paths, four consequences
| Adapter path | Failure | What follows |
|---|---|---|
| Legacy HTTP authentication | A documented placeholder bearer token could be accepted as a real secret | A reachable legacy server might be callable without a private credential |
| Workflow updates and autofix | Untrusted object keys could mutate JavaScript prototype state | Shared-process tenants might observe effects outside their own workflow |
| Stored workflow backups | Backup access relied on the original API-key value without rechecking revocation | A revoked key could continue accessing retained backup versions |
| Telemetry and logs | Sanitizers missed some nested secrets and structured values | Sensitive provider fields could reach monitoring or application logs |
The placeholder-token report is conditional on the legacy HTTP mode, not every MCP deployment. The prototype-pollution report has a particular shared-process impact under multi-tenancy, but the advisory does not prove arbitrary remote code execution. The revocation report concerns stored backup history rather than live access to n8n itself.
Version updates are not data recovery
The reports describe fixes in the 2.98.x and 2.99.x adapter release lines. That reduces exposure to repeat attempts but cannot retract data already copied into logs or change a previously leaked bearer token in a separate service. Check whether the legacy server is enabled, how backups are retained, and whether sensitive telemetry actually reached a third party.
The common engineering test is to revoke an identity, submit a maliciously structured workflow and inspect every surviving copy of its data. Authentication, memory safety and cleanup are independent controls. Passing one does not certify the others.