n8n-mcp legacy server placeholder token advisory

Evidence record

Maintainer description of a legacy MCP HTTP auth path accepting a documented placeholder token.

Read the original source ↗

Claim-level citations (2)

• supportsn8n-mcp legacy HTTP accepted a documented placeholder bearer secret: The n8n-mcp advisory identifies a legacy HTTP authentication configuration accepting a documented placeholder AUTH_TOKEN, rather than failing closed on an insecure startup configuration.

  GHSA-7mg3-m9wx-m555: USE_FIXED_HTTP, AUTH_TOKEN_FILE and fixed release

• supportsn8n-mcp legacy HTTP accepted a documented placeholder bearer secret: The separate n8n-mcp legacy HTTP server treated its publicly documented placeholder AUTH_TOKEN as an acceptable production credential. The legacy HTTP mode had to be enabled, including configurations sourcing the placeholder from a token file; deployments with a real secret were not inherently affected. A client knowing the default token could invoke exposed MCP server operations if the HTTP endpoint was reachable.

  GHSA-7mg3-m9wx-m555: USE_FIXED_HTTP, AUTH_TOKEN_FILE and fixed release