The vulnerability in n8n-MCP stems from its local workflow version history backups not being isolated between tenants when the service runs in HTTP mode with multi‑tenancy enabled (ENABLE_MULTI_TENANT=true). An authenticated tenant can therefore read, retrieve, and delete workflow version snapshots that belong to other tenants, exposing full node definitions, credential references, and authorization headers. This constitutes a privilege escalation and authorization failure (CWE‑639 and CWE‑862) that compromises confidentiality, integrity, and availability of data across all tenants. The flaw was addressed in version 2.56.1.

The affected product is n8n‑MCP (czlonkowski:n8n‑mcp). Versions prior to 2.56.1 that are running in HTTP mode with multi‑tenancy enabled via ENABLE_MULTI_TENANT=true are impacted. No other versions or deployment modes are listed as vulnerable.

The CVSS base score is 9.9 and the EPSS probability is less than 1 %. The vulnerability is not listed in the CISA KEV catalog. An authenticated tenant can exploit the flaw without additional privileges, making the attack vector relatively low in complexity. The scope spans all tenants, giving an attacker the ability to exfiltrate or destroy sensitive data across the entire instance.