Description
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations. This issue is fixed in version 2.57.4.
Published: 2026-07-15
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in n8n-MCP allows an authenticated tenant to view or delete workflow-version backups that belong to the default scope instead of being limited to the tenant's own scope. This misuse of authorization exposes sensitive backup data and can lead to data loss. The weakness corresponds to information exposure (CWE-200) and improper authorization control (CWE-863).

Affected Systems

n8n-MCP is the affected product, provided by the vendor czlonkowski. Any installation running a version earlier than 2.57.4 in multi-tenant HTTP mode with ENABLE_MULTI_TENANT set to true is vulnerable. The issue is fixed starting with release 2.57.4.

Risk and Exploitability

The CVSS score of 4.2 indicates a low-to-medium severity. The EPSS score of < 1% means that the likelihood of exploitation is very low, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated tenant; the attacker can read or delete default-scope workflow-version backups but cannot gain higher-level privileges.

Generated by OpenCVE AI on July 31, 2026 at 02:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade n8n-MCP to version 2.57.4 or later.
  • If multi-tenant functionality is not required, set ENABLE_MULTI_TENANT to false or remove the configuration.
  • Apply stricter access control to the backup API so that tenants can only access their own workflow-version backups.

Generated by OpenCVE AI on July 31, 2026 at 02:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-2cf7-hpwf-47h9 n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode
History

Fri, 17 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Czlonkowski
Czlonkowski n8n-mcp
Vendors & Products Czlonkowski
Czlonkowski n8n-mcp

Wed, 15 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Description n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations. This issue is fixed in version 2.57.4.
Title n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode
Weaknesses CWE-200
CWE-863
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Czlonkowski N8n-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-17T12:32:25.385Z

Reserved: 2026-06-16T23:31:22.445Z

Link: CVE-2026-55608

cve-icon Vulnrichment

Updated: 2026-07-17T12:32:21.627Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T03:00:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-863

    Incorrect Authorization