---
id: CVE-2026-55608
aliases:
  - GHSA-2cf7-hpwf-47h9
title: >-
  n8n-MCP: Incorrect authorization can expose default-scope workflow version
  backups in multi-tenant HTTP mode
summary: >-
  n8n-MCP: Incorrect authorization can expose default-scope workflow version
  backups in multi-tenant HTTP mode
severity: medium
cvss: 4.2
cwe:
  - CWE-200
  - CWE-863
vendor: n8n-mcp
product: n8n-mcp
ecosystem: npm
affected:
  - n8n-mcp <= 2.57.3
patched:
  - n8n-mcp 2.57.4
published: '2026-07-14'
updated: '2026-07-14'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-2cf7-hpwf-47h9'
references:
  - url: >-
      https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-2cf7-hpwf-47h9
  - url: >-
      https://github.com/czlonkowski/n8n-mcp/commit/c1ca1e73697feaec5ec2a5fb7e6992a2892b62c9
  - url: 'https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.57.4'
  - url: 'https://github.com/advisories/GHSA-2cf7-hpwf-47h9'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-14T20:39:11.129Z'
epss: 0.0028
epssPercentile: 0.18298
---

## Overview

## Summary

In multi-tenant HTTP mode (`ENABLE_MULTI_TENANT=true`), an authenticated tenant could, under certain conditions, reach n8n-mcp's local default-scope `workflow_versions` backups instead of being confined to its own tenant scope. This affects n8n-mcp's own local workflow-version storage, not a normal n8n API capability.

## Impact

An authenticated MCP HTTP tenant could read or delete workflow-version backups stored in the default (single-tenant) scope — for example backups left from a prior single-tenant deployment or a migration period. Workflow snapshots may contain sensitive workflow configuration depending on their contents. Single-tenant and stdio deployments are not affected.

## Affected versions

`<= 2.57.3`

## Patched version

`2.57.4`

## Remediation

Upgrade to n8n-mcp `2.57.4` or later. The fix requires a complete tenant context in multi-tenant mode and fails closed for workflow-version access that cannot be attributed to a specific tenant.

## Workarounds

- Restrict network access to the HTTP endpoint (firewall / reverse proxy / VPN) so only trusted callers can reach it.
- Run in stdio mode, which has no multi-tenant HTTP surface.
- If default-scope backups from a prior single-tenant deployment are not needed, removing them eliminates the exposure.

## Credit

Reported by @DavidCarliez.

## Affected packages

- `n8n-mcp <= 2.57.3`

## Remediation

Upgrade to a patched release:

- `n8n-mcp 2.57.4`