# CVE-2026-55608: czlonkowski n8n-mcp incorrect authorization in multi-tenant HTTP mode

Source: https://junglewise.ai/threats/cve-2026-55608-czlonkowski-n8n-mcp-incorrect-authorization-in-multi-tenant-http  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55608 · Severity: medium · CVSS 4.2 · Published 2026-07-15

n8n-MCP is a tool that helps Claude and other AI assistants build n8n workflows. In multi-tenant mode, an authenticated user could access workflow backups from other tenants or the default system scope, potentially exposing sensitive workflow configurations. This vulnerability only affects multi-tenant HTTP deployments; single-tenant and stdio modes are not impacted.

Technologies: [n8n-mcp (npm)](https://junglewise.ai/threats/technologies/n8n-mcp). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-55608 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55608 being exploited in the wild.

**How severe is CVE-2026-55608?** Medium severity, with a CVSS score of 4.2, published 15 July 2026.

**Which products and versions are affected?** n8n-mcp (npm) <= 2.57.3, SEMVER:introduced=0,fixed=2.57.4.

**Is there a fix for CVE-2026-55608?** Yes. n8n-mcp (npm): upgrade to 2.57.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55608 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55608?** Check whether you run n8n-mcp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- n8n-mcp (npm): upgrade to 2.57.4 or later

  ```sh
  npm install n8n-mcp@2.57.4
  ```


## Technical details

This is an incorrect authorization vulnerability (CWE-863) affecting n8n-MCP's local workflow_versions backup storage in multi-tenant HTTP mode (ENABLE_MULTI_TENANT=true). An authenticated MCP HTTP tenant could bypass tenant isolation and access or delete workflow-version backups stored in the default scope—for example, backups left from a prior single-tenant deployment or migration. The root cause is insufficient tenant context validation when accessing workflow-version resources. The attack requires network reachability to the HTTP endpoint and authentication as a valid tenant; no user interaction is needed. An attacker can read or delete sensitive workflow configurations. The fix (v2.57.4) enforces complete tenant context in multi-tenant mode and fails closed for operations that cannot be attributed to a specific tenant.

## Affected products

- czlonkowski n8n-MCP <= 2.57.3

## Identifiers

- CVE-2026-55608
- GHSA-2cf7-hpwf-47h9

## Timeline

- 2026-07-14: disclosed: GHSA-2cf7-hpwf-47h9 published on OSV
- 2026-06-13: patched: Fix released in v2.57.4
- 2026-06-14: other: Commit c1ca1e7 merged with security fix

## References

- [https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-2cf7-hpwf-47h9](https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-2cf7-hpwf-47h9)
- [https://github.com/czlonkowski/n8n-mcp/commit/c1ca1e73697feaec5ec2a5fb7e6992a2892b62c9](https://github.com/czlonkowski/n8n-mcp/commit/c1ca1e73697feaec5ec2a5fb7e6992a2892b62c9)
- [https://github.com/czlonkowski/n8n-mcp](https://github.com/czlonkowski/n8n-mcp)
- [https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.57.4](https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.57.4)

## Related threats

- [czlonkowski n8n-mcp authorization bypass in workflow backups](https://junglewise.ai/threats/cve-2026-54052-czlonkowski-n8n-mcp-authorization-bypass-in-workflow-backups)
- [czlonkowski n8n-mcp improper access control in multi-tenant mode](https://junglewise.ai/threats/cve-2026-45707-czlonkowski-n8n-mcp-improper-access-control-in-multi-tenant-mode)
- [czlonkowski n8n-mcp sensitive information leak in workflow telemetry](https://junglewise.ai/threats/cve-2026-45582-czlonkowski-n8n-mcp-sensitive-information-leak-in-workflow)
- [czlonkowski n8n-mcp authenticated SSRF in webhook and API client](https://junglewise.ai/threats/cve-2026-44694-czlonkowski-n8n-mcp-ssrf-in-webhook-and-api-client-paths)
- [czlonkowski n8n-mcp sensitive information disclosure in logs](https://junglewise.ai/threats/cve-2026-42282-czlonkowski-n8n-mcp-sensitive-information-leak-in-logs)