CVE-2026-54052: 
JavaScript vulnerability analysis and mitigation

CVE-2026-54052 is a cross-tenant authorization bypass vulnerability in n8n-MCP, an MCP server that provides AI assistants access to n8n node documentation and workflow operations. In HTTP mode with multi-tenancy enabled (ENABLE_MULTI_TENANT=true), workflow version history backups were not isolated per tenant, allowing any authenticated tenant to read, delete, or destroy workflow version snapshots belonging to other tenants. All versions up to and including 2.56.0 are affected; the issue was originally reported on June 3, 2026, published to the GitHub Advisory Database on July 14, 2026, and assigned a CVSS v3.1 base score of 9.9 (Critical) (Github Advisory, Security Advisory).

The root cause is a missing per-tenant scope on the local workflow version history store, classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). When a tenant invokes the n8n_workflow_versions tool, the server does not enforce tenant isolation on the underlying shared database, allowing a user-controlled key (e.g., a workflow or version identifier) to resolve records belonging to other tenants. Because stored snapshots include full node definitions — which can embed credential references and authorization headers — the exposure extends beyond metadata to sensitive secrets. The vulnerability is only present in HTTP multi-tenant deployments; stdio/single-user and single-tenant HTTP deployments are not affected (Github Advisory, Security Advisory).

An authenticated tenant in a vulnerable multi-tenant deployment can read workflow version snapshots owned by other tenants, exposing full node definitions that may contain credential references and authorization headers — a significant confidentiality breach. Additionally, the attacker can delete or corrupt other tenants' stored workflow backups, impacting both integrity and availability of those backups. The changed scope (S:C) in the CVSS vector reflects that the impact crosses tenant security boundaries, potentially enabling lateral movement to systems or services whose credentials are embedded in exposed workflow nodes (Github Advisory, Security Advisory).

1. Identify target: Confirm the n8n-MCP server is running in HTTP mode with ENABLE_MULTI_TENANT=true and is running version 2.56.0 or earlier.
2. Obtain tenant credentials: Register or obtain valid credentials for any tenant account on the shared n8n-MCP instance.
3. Authenticate: Authenticate to the HTTP endpoint using the obtained tenant credentials to receive a valid session or API token.
4. Invoke the workflow versions tool: Call the n8n_workflow_versions tool (or equivalent API endpoint) without restricting the query to the attacker's own tenant scope — the server does not enforce tenant isolation on the shared database.
5. Enumerate cross-tenant snapshots: Iterate over workflow or version identifiers (e.g., by incrementing IDs or using known patterns) to retrieve workflow version snapshots belonging to other tenants.
6. Extract sensitive data: Parse the returned snapshots for full node definitions, which may contain credential references, API keys, and authorization headers configured on workflow nodes.
7. Delete or corrupt backups (optional): Issue delete requests against other tenants' version history entries to destroy their backups, impacting integrity and availability (Github Advisory, Security Advisory).

• Network: Unusual HTTP requests to the n8n_workflow_versions tool endpoint from a single tenant account accessing a high volume of workflow version IDs in rapid succession; requests referencing workflow IDs not associated with the authenticated tenant.
• Logs: Server access logs showing a single tenant session querying or deleting version history records across multiple workflow namespaces or tenant scopes; repeated version history read/delete operations outside normal usage patterns.
• Application Behavior: Unexpected deletion or disappearance of workflow version backups for tenants who did not initiate any version management actions; tenants reporting missing backup history without corresponding legitimate activity.

Upgrade to n8n-MCP version 2.56.1 or later, which scopes workflow version history per instance and runs a one-time migration on upgrade to isolate existing history and clear previously un-scoped backups (Release v2.56.1). If an immediate upgrade is not possible, disable the affected tool by setting DISABLED_TOOLS=n8n_workflow_versions in the server environment (e.g., Docker .env), which closes the cross-tenant access path while leaving automatic backups intact. As an architectural workaround, serve each tenant from a separate n8n-MCP instance with its own database to eliminate shared local storage. Restricting network access to the HTTP endpoint to trusted operators also reduces exposure (Github Advisory).

The vulnerability was reported by Francisco Rosales (@0xmagic0) and coordinated by Ax Sharma (@axsharma) of Manifold Security, who disclosed it responsibly to the maintainer (Security Advisory). The issue received coverage from automated security tracking platforms including Tenable, VulDB, and OSV shortly after publication. Social media activity was limited, with brief mentions on Mastodon and Bluesky, and the vulnerability was included in a CISA weekly bulletin, indicating routine tracking rather than elevated threat response.