Issue Station
Sign In
Tools hereToolbox

n8n - 💡(How to fix) Fix MongoDB Chat Memory: connection-string TypeError leaks credentials into error message [1 pull requests]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Error Message

The catch block in MemoryMongoDbChat.node.ts (end of supplyData, ~L165) embeds the raw mongodb driver error.message execution:read but not credential:read on the project can read the password from the persisted error data. 4. Open the failed execution. The error message reads: "MongoDB connection error: Invalid URL: mongodb://leaky_user:supersecret123@:27017/?appname=n8n".

  1. Validate that host is non-empty when building the connection string in MemoryMongoDbChat.node.ts — surface a clear "host is required" error before invoking MongoClient.
  2. Sanitize the embedded error.message via a regex like /mongodb(+srv)?://[^:\s]+:[^@\s]+@/gi → "mongodb$1://[REDACTED]@" before passing it to NodeOperationError. This is the more defense-in-depth move because other URL-parse error paths can
  • error: all

Root Cause

Severity calibrated honestly: CVSS ~3.0–3.5 (Low). Defense-in-depth, not a remote-exploit. Filing as a regular bug rather than VDP because the trigger requires the credential owner to misconfigure their own credentials. Happy to be re-routed to security if your team prefers.

Fix Action

Fixed

RAW_BUFFERClick to expand / collapse

Bug Description

The catch block in MemoryMongoDbChat.node.ts (end of supplyData, ~L165) embeds the raw mongodb driver error.message verbatim into a NodeOperationError. When credentials.host is empty (the "Values" configuration type has no required-validation on host — default is 'localhost' but the field can be cleared and saved), the driver throws TypeError("Invalid URL: mongodb://user:pass@:port/...") with the full URI in both message and stack.

That message persists into execution data via NodeOperationError.toJSON, into server logs, and into Sentry if the operator has it configured.

The leak crosses a real privilege boundary in n8n's permission model: execution:read and credential:read are separate scopes (see packages/@n8n/permissions/src/tests/types.test.ts — both enumerated as separate valid scopes). A user with execution:read but not credential:read on the project can read the password from the persisted error data.

Verified at code level with the mongodb npm driver. The TypeError comes from Node's WHATWG URL constructor inside MongoClient init — it includes the full input URI by design. NodeOperationError.toJSON output confirmed to contain the password verbatim in a minimal reproduction.

Severity calibrated honestly: CVSS ~3.0–3.5 (Low). Defense-in-depth, not a remote-exploit. Filing as a regular bug rather than VDP because the trigger requires the credential owner to misconfigure their own credentials. Happy to be re-routed to security if your team prefers.

To Reproduce

To Reproduce

  1. Create a MongoDB credential. Configuration Type: Values. Set User=leaky_user, Password=supersecret123, Port=27017. Clear the Host field (default is 'localhost' — actively delete it). Save.

  2. Build a workflow with an AI Agent + MongoDB Chat Memory node referencing this credential.

  3. Execute the workflow.

  4. Open the failed execution. The error message reads: "MongoDB connection error: Invalid URL: mongodb://leaky_user:supersecret123@:27017/?appname=n8n".

  5. Optional confirmation — query the executions table (or fetch via API) and inspect the executionData column. The full URI persists there.

Expected behavior

Expected behavior

Either:

  1. Validate that host is non-empty when building the connection string in MemoryMongoDbChat.node.ts — surface a clear "host is required" error before invoking MongoClient.

  2. Sanitize the embedded error.message via a regex like /mongodb(+srv)?://[^:\s]+:[^@\s]+@/gi → "mongodb$1://[REDACTED]@" before passing it to NodeOperationError. This is the more defense-in-depth move because other URL-parse error paths can trigger similar leaks.

Option 1 is the minimal fix. Option 2 is more comprehensive and applies cleanly to any sibling node that builds DB URIs with embedded credentials.

Happy to PR either or both — let me know your preference and I'll open the PR.

Debug Info

Debug info

core

  • n8nVersion: 2.20.9
  • platform: docker (self-hosted)
  • nodeJsVersion: 24.14.1
  • nodeEnv: production
  • database: sqlite
  • executionMode: regular
  • concurrency: -1
  • license: community
  • consumerId: unknown

storage

  • success: all
  • error: all
  • progress: false
  • manual: true
  • binaryMode: filesystem

pruning

  • enabled: true
  • maxAge: 336 hours
  • maxCount: 10000 executions

client

  • userAgent: mozilla/5.0 (macintosh; intel mac os x 10_15_7) applewebkit/537.36 (khtml, like gecko) chrome/147.0.0.0 safari/537.36
  • isTouchDevice: false

cluster

  • instanceCount: 1
  • versions: 2.20.9
  • instances:
    • instanceKey: b8884007-f91a-4e24-b237-334cd73f208f, hostId: main-e13507a34eb7, instanceType: main, instanceRole: leader, version: 2.20.9
  • checks:
    • check: hostid-clash, status: succeeded, warnings: -
    • check: lifecycle, status: succeeded, warnings: -
    • check: split-brain, status: succeeded, warnings: -
    • check: version-mismatch, status: succeeded, warnings: -

Generated at: 2026-05-18T06:49:41.834Z

Operating System

macOS (host) — n8n 2.20.9 running in Docker container (docker.n8n.io/n8nio/n8n)

n8n Version

2.20.9

Node.js Version

24.14.1

Database

SQLite (default)

Execution mode

main (default)

Hosting

self hosted

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Expected behavior

Either:

  1. Validate that host is non-empty when building the connection string in MemoryMongoDbChat.node.ts — surface a clear "host is required" error before invoking MongoClient.

  2. Sanitize the embedded error.message via a regex like /mongodb(+srv)?://[^:\s]+:[^@\s]+@/gi → "mongodb$1://[REDACTED]@" before passing it to NodeOperationError. This is the more defense-in-depth move because other URL-parse error paths can trigger similar leaks.

Option 1 is the minimal fix. Option 2 is more comprehensive and applies cleanly to any sibling node that builds DB URIs with embedded credentials.

Happy to PR either or both — let me know your preference and I'll open the PR.

#api#configuration error#environment variable#network issue#logging issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

n8n - 💡(How to fix) Fix MongoDB Chat Memory: connection-string TypeError leaks credentials into error message [1 pull requests]