# CVE-2026-54052: czlonkowski n8n-mcp authorization bypass in workflow backups

Source: https://junglewise.ai/threats/cve-2026-54052-czlonkowski-n8n-mcp-authorization-bypass-in-workflow-backups  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-54052 · Severity: critical · CVSS 9.9 · Published 2026-07-15

n8n-mcp is a server that allows AI assistants to interact with n8n automation workflows. In multi-tenant configurations, a security flaw allowed one user to access, read, or delete the workflow backups belonging to other users. This could lead to the exposure of sensitive information, including authorization headers and credential references used in automated business processes.

Technologies: [n8n-mcp (npm)](https://junglewise.ai/threats/technologies/n8n-mcp). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54052 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54052 being exploited in the wild.

**How severe is CVE-2026-54052?** Critical severity, with a CVSS score of 9.9, published 15 July 2026.

**Which products and versions are affected?** n8n-mcp (npm) <= 2.56.0, SEMVER:introduced=0,fixed=2.56.1.

**Is there a fix for CVE-2026-54052?** Yes. n8n-mcp (npm): upgrade to 2.56.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54052 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54052?** Check whether you run n8n-mcp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- n8n-mcp (npm): upgrade to 2.56.1 or later

  ```sh
  npm install n8n-mcp@2.56.1
  ```


## Technical details

A broken access control vulnerability (CWE-639/CWE-862) exists in n8n-mcp when running in HTTP mode with ENABLE_MULTI_TENANT=true. The local workflow version history backups were not properly scoped to individual tenants, allowing an authenticated tenant to perform unauthorized CRUD operations on snapshots belonging to others. These snapshots contain full node definitions, which may include sensitive credential references and authorization headers. The vulnerability is exploited via network requests to the workflow version tool. A fix is available in version 2.56.1, which implements instance-based isolation for backups.

## Affected products

- czlonkowski n8n-mcp < 2.56.1

## Identifiers

- CVE-2026-54052
- GHSA-j6r7-6fhx-77wx

## Timeline

- 2026-06-02: patched: Version 2.56.1 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date

## References

- [https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.56.1](https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.56.1)
- [https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-j6r7-6fhx-77wx](https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-j6r7-6fhx-77wx)

## Related threats

- [czlonkowski n8n-mcp incorrect authorization in multi-tenant HTTP mode](https://junglewise.ai/threats/cve-2026-55608-czlonkowski-n8n-mcp-incorrect-authorization-in-multi-tenant-http)
- [czlonkowski n8n-mcp improper access control in multi-tenant mode](https://junglewise.ai/threats/cve-2026-45707-czlonkowski-n8n-mcp-improper-access-control-in-multi-tenant-mode)
- [czlonkowski n8n-mcp sensitive information leak in workflow telemetry](https://junglewise.ai/threats/cve-2026-45582-czlonkowski-n8n-mcp-sensitive-information-leak-in-workflow)
- [czlonkowski n8n-mcp authenticated SSRF in webhook and API client](https://junglewise.ai/threats/cve-2026-44694-czlonkowski-n8n-mcp-ssrf-in-webhook-and-api-client-paths)
- [czlonkowski n8n-mcp sensitive information disclosure in logs](https://junglewise.ai/threats/cve-2026-42282-czlonkowski-n8n-mcp-sensitive-information-leak-in-logs)