Read the docs
TI-2026-38986 Aliases CVE-2026-54052GHSA-j6r7-6fhx-77wx

n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

Priority MEDIUM 43CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destroy other tenants' stored backups, including full node definitions, credential references, and authorization headers. This issue is fixed in version 2.56.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix Fixed n8n-mcp (czlonkowski): 2.56.1n8n-mcp (npm): 2.56.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
czlonkowskin8n-mcpbefore 2.56.12.56.1Patch availableCNA
—n8n-mcp (npm)before 2.56.12.56.1Patch availableGHSA-j6r7-6fhx-77wx
  • n8n-mcp Vendorczlonkowski Affected before 2.56.1 Fixed in 2.56.1 Patch available CNA
  • n8n-mcp (npm) Vendor— Affected before 2.56.1 Fixed in 2.56.1 Patch available GHSA-j6r7-6fhx-77wx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:*before 2.56.1Vulnerableczlonkowski
  • cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:* Versions before 2.56.1 Vulnerable ·czlonkowski

Remediation

  • Fix · CNA n8n-mcp (czlonkowski) Fixed in 2.56.1
  • Fix · GHSA-j6r7-6fhx-77wx n8n-mcp (npm) Fixed in 2.56.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54052
  2. 2026-10-03 Alias added: GHSA-j6r7-6fhx-77wx

References

Advisory 1

Other 2

  • TI-2026-28830 n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode CVSS 3.1HIGH 8.5
  • TI-2026-30738 n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders CVSS 3.1HIGH 8.5
  • TI-2026-33447 Improper access control in czlonkowski n8n-mcp CVSS 3.1HIGH 8.1
  • TI-2026-32585 n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths CVSS 4.0HIGH 7.2
  • TI-2026-30081 n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests CVSS 3.1MEDIUM 5.3
  • TI-2026-33331 n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences