Is CVE-2026-45707 actively exploited?

No active exploitation of CVE-2026-45707 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-45707 be exploited remotely?

Yes. CVE-2026-45707 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-45707?

CVE-2026-45707 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-45707

HIGH

CVE-2026-45707

CWE-284Published: May 29, 2026· Updated: Jun 1, 2026

8.1

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.1th

Official Description

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.2, when ENABLE_MULTI_TENANT=true, the HTTP transport documents that the target n8n instance is selected per-request from x-n8n-url / x-n8n-key headers. Requests that omitted those headers — or supplied only one of them — silently fell back to the process-level N8N_API_URL / N8N_API_KEY credentials configured for the operator's own n8n instance. As a result, an authenticated MCP tenant could cause n8n management calls to execute against the operator's instance instead of its own. This affects HTTP-mode deployments of n8n-mcp that are run as a shared multi-tenant service. Single-tenant deployments (ENABLE_MULTI_TENANT unset or false) are not affected. This vulnerability is fixed in 2.51.2.

NVD Source

Technical Analysis

CVE-2026-45707 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.