What is the CVSS score of CVE-2026-55608?

CVE-2026-55608 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-55608?

Yes, a patch is available for CVE-2026-55608. Update the affected software to the latest version immediately.

n8n-mcp CVE-2026-55608

Q: Which versions of n8n-mcp are affected by CVE-2026-55608?

Tenant scope isolation bypass in n8n-mcp's multi-tenant HTTP mode allows an authenticated tenant to read or delete default-scope workflow_versions backups that should be inaccessible to that tenant.. A patch is available.

MEDIUM

Information Exposure (CWE-200)

2026-07-14 https://github.com/czlonkowski/n8n-mcp

GHSA-2cf7-hpwf-47h9

Information Disclosure

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (https://github.com/czlonkowski/n8n-mcp) PRIMARY

MEDIUM

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Tenant credentials required (PR:L); impact limited to reading or deleting one backup scope, not full data access (C:L/I:L/A:N); no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/czlonkowski/n8n-mcp).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 12:36 vuln.today

Analysis Generated

Jul 22, 2026 - 12:36 vuln.today

CVSS changed

Jul 17, 2026 - 17:22 NVD

4.2 (MEDIUM) 5.4 (MEDIUM)

DescriptionNVD

Summary

In multi-tenant HTTP mode (ENABLE_MULTI_TENANT=true), an authenticated tenant could, under certain conditions, reach n8n-mcp's local default-scope workflow_versions backups instead of being confined to its own tenant scope. This affects n8n-mcp's own local workflow-version storage, not a normal n8n API capability.

Impact

An authenticated MCP HTTP tenant could read or delete workflow-version backups stored in the default (single-tenant) scope - for example backups left from a prior single-tenant deployment or a migration period. Workflow snapshots may contain sensitive workflow configuration depending on their contents. Single-tenant and stdio deployments are not affected.

Affected versions

<= 2.57.3

Patched version

2.57.4

Remediation

Upgrade to n8n-mcp 2.57.4 or later. The fix requires a complete tenant context in multi-tenant mode and fails closed for workflow-version access that cannot be attributed to a specific tenant.

Workarounds

Restrict network access to the HTTP endpoint (firewall / reverse proxy / VPN) so only trusted callers can reach it.
Run in stdio mode, which has no multi-tenant HTTP surface.
If default-scope backups from a prior single-tenant deployment are not needed, removing them eliminates the exposure.

Credit

Reported by @DavidCarliez.

AnalysisAI

Tenant scope isolation bypass in n8n-mcp's multi-tenant HTTP mode allows an authenticated tenant to read or delete default-scope workflow_versions backups that should be inaccessible to that tenant. Versions through 2.57.3 running with ENABLE_MULTI_TENANT=true are affected; the flaw stems from an inverted boolean guard that fails open when a tenant supplies only one of the two required credentials (URL or API key) rather than both. No public exploit code exists and CISA KEV does not list this CVE - EPSS at 0.26% and SSVC exploitation status 'none' confirm low real-world exploitation likelihood at time of analysis.

Technical ContextAI

n8n-mcp (pkg:npm/n8n-mcp) is an npm package implementing a Model Context Protocol server for n8n workflow automation. In multi-tenant HTTP mode, each tenant is expected to be fully identified by both a URL and an API key before being permitted access to its own tenant-scoped storage. The root cause (CWE-200: Exposure of Sensitive Information to Unauthorized Actor) is a single-character logical operator error in http-server-single-session.js: the pre-patch condition !hasUrl && !hasKey (reject only when BOTH are absent) was corrected to !hasUrl || !hasKey (reject when EITHER is absent). A tenant presenting only one credential could therefore slip through the check and reach the default single-tenant scope's workflow_versions table - a storage area populated by prior single-tenant deployments or migrations. The vulnerability is entirely within n8n-mcp's own local backup storage layer and is unrelated to the upstream n8n API.

RemediationAI

Upgrade n8n-mcp to version 2.57.4 or later, which corrects the tenant authorization guard to fail closed when either the URL or the API key is absent (patch commit c1ca1e73697feaec5ec2a5fb7e6992a2892b62c9; advisory GHSA-2cf7-hpwf-47h9 at https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-2cf7-hpwf-47h9). If immediate upgrade is not feasible, three workarounds reduce exposure: (1) restrict network access to the MCP HTTP endpoint via firewall, reverse proxy, or VPN to ensure only fully-trusted callers can reach it - this narrows the attack surface but does not fix the underlying logic flaw; (2) switch to stdio mode, which eliminates the multi-tenant HTTP surface entirely, though this changes the operational deployment model; (3) if default-scope workflow_versions backups from a prior single-tenant deployment are no longer needed, deleting them removes the exposed data and eliminates the practical impact, though the flaw itself remains present until patched.