CVE-2026-55608: 
JavaScript vulnerability analysis and mitigation

CVE-2026-55608 is an incorrect authorization vulnerability in n8n-MCP (an MCP server providing AI assistants access to n8n workflow automation) that allows authenticated tenants in multi-tenant HTTP mode to access or delete workflow-version backups outside their assigned tenant scope. The flaw affects all n8n-mcp versions up to and including 2.57.3 when deployed with ENABLE_MULTI_TENANT=true; single-tenant and stdio deployments are not affected. It was originally published on June 14, 2026, and added to the GitHub Advisory Database on July 14, 2026. The CVSS v3.1 base score is 4.2 (Moderate) (Github Advisory, Security Advisory).

The root cause is an incomplete tenant context check in the multi-tenant HTTP request handler (CWE-863: Incorrect Authorization; CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). Prior to the fix, the server only rejected requests where both tenant headers (x-n8n-url and x-n8n-key) were absent; a request supplying only one header could bypass the guard and fall through to the default (single-tenant) scope for workflow_versions backup operations. The patch in commit 1f42899 tightens the condition from !hasUrl && !hasKey to !hasUrl || !hasKey, ensuring any incomplete tenant context is rejected with a 400 error rather than silently falling back to the operator-level scope (Fix Commit, Security Advisory).

An authenticated MCP HTTP tenant can read or delete workflow_versions backups stored in the default single-tenant scope — data that may include sensitive workflow configurations, credentials embedded in workflow nodes, and automation logic left over from prior single-tenant deployments or migration periods. The integrity impact allows deletion of these backups, potentially causing irreversible data loss. Availability is not directly impacted, and the scope is limited to n8n-mcp's local workflow-version storage rather than the broader n8n API (Github Advisory, Security Advisory).

1. Identify target: Locate an n8n-mcp instance running in multi-tenant HTTP mode (ENABLE_MULTI_TENANT=true) on versions ≤ 2.57.3, accessible over the network.
2. Obtain tenant credentials: Acquire valid tenant authentication credentials (e.g., a legitimate tenant API key or session token) for the target instance.
3. Craft a partial-context request: Send an authenticated HTTP request to the n8n-mcp MCP endpoint supplying only one of the two required tenant headers (either x-n8n-url or x-n8n-key), but not both, to trigger the incomplete context fallback.
4. Access default-scope backups: Issue workflow-version backup read or delete operations; due to the faulty && guard, the server falls through to the default single-tenant scope instead of the caller's tenant scope, granting access to workflow_versions backups from prior deployments.
5. Exfiltrate or destroy data: Read sensitive workflow configuration from the exposed backups, or delete them to cause data loss (Security Advisory, Fix Commit).

• Network: Authenticated HTTP requests to the n8n-mcp endpoint that include only one of the two expected tenant headers (x-n8n-url or x-n8n-key) but not both, particularly targeting workflow-version backup endpoints.
• Logs: Server access logs showing requests from tenant-authenticated sessions accessing workflow_versions resources associated with the default (non-tenant) scope; log entries with warn level messages about missing tenant headers on versions prior to 2.57.4 (patched versions emit a 400 and log both header states).
• File System: Unexpected access timestamps or deletion events on workflow_versions backup files in the default-scope storage directory of the n8n-mcp deployment.
• Application Behavior: Workflow-version backups from a prior single-tenant deployment disappearing or being accessed by tenant accounts that should not have visibility into the default scope.

Upgrade n8n-mcp to version 2.57.4 or later, which enforces that both x-n8n-url and x-n8n-key headers must be present for any multi-tenant request, failing closed on incomplete context (Github Release). If immediate upgrade is not possible, apply one or more of the following workarounds: restrict network access to the HTTP endpoint via firewall, reverse proxy, or VPN so only trusted callers can reach it; switch to stdio mode, which has no multi-tenant HTTP surface; or delete default-scope workflow_versions backups from prior single-tenant deployments if they are no longer needed, eliminating the exposed data (Security Advisory).

The vulnerability was reported by security researcher @DavidCarliez and addressed promptly by the maintainer in the same release cycle. No significant broader media coverage or notable public researcher commentary beyond the GitHub advisory has been identified.