Critical severity · published Jul 15, 2026
CVE-2026-54052
n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments
9.9
CVSS
0.4%
EPSS
No
On KEV
Description
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destroy other tenants' stored backups, including full node definitions, credential references, and authorization headers. This issue is fixed in version 2.56.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
N8
n8n-mcp · czlonkowski
< 2.56.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54052
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54052
Release Notes
https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.56.1
Mitigation
https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-j6r7-6fhx-77wx
More from n8n-mcp
9.1
CVE-2026-44694
n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths
8.5
CVE-2026-42449
n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
8.5
CVE-2026-39974
n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode
8.1
CVE-2026-45707
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
6.5
CVE-2026-45582
n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters