CVE-2026-54052

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destroy other tenants' stored backups, including full node definitions, credential references, and authorization headers. This issue is fixed in version 2.56.1.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.56.1	Release Notes
https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-j6r7-6fhx-77wx	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) n8n-MCP es un servidor MCP que proporciona a los asistentes de IA acceso a la documentación, propiedades y operaciones de los nodos n8n. Antes de la versión 2.56.1, en modo HTTP con multi-tenencia habilitada a través de ENABLE_MULTI_TENANT=true, las copias de seguridad locales del historial de versiones de los flujos de trabajo de n8n-mcp no estaban aisladas por inquilino, lo que permitía a un inquilino autenticado leer instantáneas de versiones de flujos de trabajo pertenecientes a otros inquilinos y eliminar o destruir las copias de seguridad almacenadas de otros inquilinos, incluyendo definiciones completas de nodos, referencias de credenciales y encabezados de autorización. Este problema está solucionado en la versión 2.56.1.

Information

Published : 2026-07-15 21:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-54052

Mitre link : CVE-2026-54052

CVE.ORG link : CVE-2026-54052

JSON object : View

Products Affected

n8n-mcp

n8n-mcp

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-54052", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54052", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-18T01:54:48.414610Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "czlonkowski", "product": "n8n-mcp", "versions": [{"status": "affected", "version": "< 2.56.1"}]}]}], "published": "2026-07-15T21:16:54.797", "references": [{"url": "https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.56.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-j6r7-6fhx-77wx", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destroy other tenants' stored backups, including full node definitions, credential references, and authorization headers. This issue is fixed in version 2.56.1."}, {"lang": "es", "value": "n8n-MCP es un servidor MCP que proporciona a los asistentes de IA acceso a la documentaci\u00f3n, propiedades y operaciones de los nodos n8n. Antes de la versi\u00f3n 2.56.1, en modo HTTP con multi-tenencia habilitada a trav\u00e9s de ENABLE_MULTI_TENANT=true, las copias de seguridad locales del historial de versiones de los flujos de trabajo de n8n-mcp no estaban aisladas por inquilino, lo que permit\u00eda a un inquilino autenticado leer instant\u00e1neas de versiones de flujos de trabajo pertenecientes a otros inquilinos y eliminar o destruir las copias de seguridad almacenadas de otros inquilinos, incluyendo definiciones completas de nodos, referencias de credenciales y encabezados de autorizaci\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 2.56.1."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n-mcp:n8n-mcp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F24A4D6-C2A3-424A-A70E-6EF1050F7736", "versionEndExcluding": "2.56.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}