Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2026-55608

n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

Description

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations. This issue is fixed in version 2.57.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

czlonkowski n8n-mcp

  • < 2.57.4affected

References