n8n-mcp CVE-2026-54052
CRITICAL
GHSA-j6r7-6fhx-77wx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Authenticated tenant (PR:L) reaches other tenants' data over the network, crossing a trust boundary (S:C) with high confidentiality/integrity and only low availability impact (backups destroyed, service intact).
Primary rating from Vendor (https://github.com/czlonkowski/n8n-mcp).
CVSS VectorVendor: https://github.com/czlonkowski/n8n-mcp
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
Impact
In multi-tenant HTTP deployments - where a single n8n-mcp server serves several tenants - the locally stored workflow version history (the automatic backups taken before workflow updates) was not isolated per tenant. An authenticated tenant could read workflow version snapshots belonging to other tenants, and could delete or destroy other tenants' stored backups.
A stored snapshot includes full node definitions, so the exposed data can contain credential references and authorization headers configured on nodes. This is therefore a confidentiality issue in addition to an integrity/availability one.
Affected configurations
- HTTP mode with multi-tenancy enabled (
ENABLE_MULTI_TENANT=true), where multiple tenants are served by a single shared instance and database.
Not affected:
- stdio / single-user deployments (e.g. Claude Desktop).
- Single-tenant HTTP deployments (one tenant per instance and database).
Affected versions
<= 2.56.0
Patched version
2.56.1. The stored version history is now isolated per instance, so a tenant can only access its own backups. Upgrading runs a one-time migration that isolates existing history and clears previously stored, un-scoped backups (these are auto-created, short-retention backups).
Workarounds
If users cannot upgrade immediately:
- Disable the workflow version tool by setting
DISABLED_TOOLS=n8n_workflow_versionsin the server environment (for example, in your Docker.env). This removes the affected tool from the deployment for all tenants; automatic backups are unaffected, but the cross-tenant access path is closed. - Alternatively, do not run in multi-tenant mode - serve each tenant from a separate instance with its own database, so no local store is shared between tenants.
- Restrict network access to the HTTP endpoint to trusted operators.
stdio and single-tenant HTTP deployments are not affected.
Credit
Reported by Francisco Rosales (@0xmagic0) and coordinated by Ax Sharma (@axsharma) of Manifold Security.
Articles & Coverage 1
AnalysisAI
Cross-tenant data exposure in n8n-mcp (npm package, <= 2.56.0) lets an authenticated tenant on a shared multi-tenant HTTP instance read, delete, and destroy the automatic workflow version backups belonging to other tenants. Because each snapshot embeds full node definitions, the leaked data can include credential references and authorization headers, making this both a confidentiality and an integrity/availability failure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the server running in HTTP mode with multi-tenancy explicitly enabled (ENABLE_MULTI_TENANT=true) and multiple tenants sharing a single instance and database, plus valid authenticated access as one tenant (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, score 9.9) is driven largely by the scope change (S:C): a low-privileged authenticated tenant crosses into other tenants' data, yielding high confidentiality and integrity impact with low availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a shared multi-tenant n8n-mcp HTTP instance, a legitimate but malicious tenant authenticates and invokes the workflow-versions tooling to enumerate and read version snapshots belonging to other tenants, harvesting the credential references and authorization headers embedded in their node definitions. The same access lets the attacker delete or destroy victims' backups, causing loss of recovery points. … |
| Remediation | Vendor-released patch: 2.56.1 - upgrade to n8n-mcp 2.56.1, which isolates version history per instance and runs a one-time migration that isolates existing history and clears previously stored un-scoped backups (auto-created, short-retention data, so the purge is low impact). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production deployments of n8n-mcp version 2.56.0 or earlier, inventory which customer tenants share HTTP instances, and begin reviewing access logs and backup modification timestamps for evidence of cross-tenant access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Unauthenticated remote code execution in 9router (npm package) versions 0.4.30 through 0.4.36 allows network-adjacent at
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today