Evidence · DiggingBeagle record
n8n-mcp telemetry sanitizer credential exposure advisory
Maintainer report documenting nested secret and user-data leakage into telemetry and logs.
- Source role
- primary disclosure
Evidence record
Maintainer report documenting nested secret and user-data leakage into telemetry and logs.
Claim-level citations (2)
- supportsn8n-mcp redaction missed nested credentials in telemetry and logs: The n8n-mcp telemetry advisory reproduces credentials or personal details reaching anonymous event attributes or server logs when nested or malformed tool inputs bypassed sanitization.
GHSA-rqgx-cvr7-hc6x: telemetry sanitizer bypass, nested structured strings and patched release
- supportsn8n-mcp redaction missed nested credentials in telemetry and logs: The n8n-mcp adapter sanitized some API requests but still serialized nested credential fields, JSON strings and certain malformed arguments into telemetry or error logs. The relevant execution must enable affected telemetry or logging paths and process tool inputs containing secret or personal fields. Synthetic secret markers could pass into telemetry attributes or raw log prefixes where operators or processors might later read them.
GHSA-rqgx-cvr7-hc6x: telemetry sanitizer bypass, nested structured strings and patched release