CVE-2026-55608: czlonkowski n8n-mcp incorrect authorization in multi-tenant HTTP mode

CVE-2026-55608 · Severity: medium · CVSS 4.2 · Published 2026-07-15

n8n-MCP is a tool that helps Claude and other AI assistants build n8n workflows. In multi-tenant mode, an authenticated user could access workflow backups from other tenants or the default system scope, potentially exposing sensitive workflow configurations. This vulnerability only affects multi-tenant HTTP deployments; single-tenant and stdio modes are not impacted.

Technologies: n8n-mcp (npm). Vendors: npm.

Quick answers

Is CVE-2026-55608 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55608 being exploited in the wild.
How severe is CVE-2026-55608?
Medium severity, with a CVSS score of 4.2, published 15 July 2026.
Which products and versions are affected?
n8n-mcp (npm) <= 2.57.3, SEMVER:introduced=0,fixed=2.57.4.
Is there a fix for CVE-2026-55608?
Yes. n8n-mcp (npm): upgrade to 2.57.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55608 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55608?
Check whether you run n8n-mcp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • n8n-mcp (npm): upgrade to 2.57.4 or later
    npm install n8n-mcp@2.57.4

Technical details

This is an incorrect authorization vulnerability (CWE-863) affecting n8n-MCP's local workflow_versions backup storage in multi-tenant HTTP mode (ENABLE_MULTI_TENANT=true). An authenticated MCP HTTP tenant could bypass tenant isolation and access or delete workflow-version backups stored in the default scope—for example, backups left from a prior single-tenant deployment or migration. The root cause is insufficient tenant context validation when accessing workflow-version resources. The attack requires network reachability to the HTTP endpoint and authentication as a valid tenant; no user interaction is needed. An attacker can read or delete sensitive workflow configurations. The fix (v2.57.4) enforces complete tenant context in multi-tenant mode and fails closed for operations that cannot be attributed to a specific tenant.

Affected products

  • czlonkowski n8n-MCP <= 2.57.3

Identifiers

  • CVE-2026-55608
  • GHSA-2cf7-hpwf-47h9

Timeline

  • 2026-07-14: disclosed: GHSA-2cf7-hpwf-47h9 published on OSV
  • 2026-06-13: patched: Fix released in v2.57.4
  • 2026-06-14: other: Commit c1ca1e7 merged with security fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.