n8n-MCP is a multi‑tenant server that exposes AI assistants to n8n node documentation and management APIs. When multi‑tenant mode is enabled, the target n8n instance is selected for each request by the x-n8n-url and x-n8n-key headers. If a request omits one or both of these headers, the server silently falls back to the process‑level N8N_API_URL and N8N_API_KEY credentials that belong to the operator’s own instance. As a result, an authenticated tenant can issue management calls that act against the operator’s n8n instance, potentially modifying data or initiating arbitrary actions. This reflects an insecure permission handling weakness (CWE‑284).

The vulnerability affects the czlonkowski:n8n‑mcp product, versions prior to 2.51.2, when ENABLE_MULTI_TENANT is set to true and the service is deployed in HTTP mode as a shared multi‑tenant service. Single‑tenant configurations are not impacted.

The CVSS score of 8.1 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers only need authenticated access to the MCP tenant and the ability to send HTTP requests; no additional conditions are required. The likely attack vector is HTTP requests to the MCP server that omit the tenant headers, causing the fallback to operator credentials. Because the operator’s API key is used, the attacker can perform privileged operations on the operator’s n8n instance.