CVE-2026-54052 n8n-mcp vulnerability
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destroy other tenants' stored backups, including full node definitions, credential references, and authorization headers. This issue is fixed in version 2.56.1.
Browse Authorization Bypass security risksQuick answer
n8n-mcp should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- < 2.56.1
Fixed versions
- 2.56.1
How to fix it
n8n-mcp is affected by CVE-2026-54052, a cross-tenant workflow version history access flaw. An authenticated tenant can read or destroy another tenant's snapshots, including node definitions, credential references, and authorization headers. Upgrade n8n-mcp to 2.56.1 or later and confirm its one-time history migration completes. Treat exposed production systems as an urgent patch and incident-review priority.
- Inventory every n8n-mcp deployment, version, exposed endpoint, environment, and owner.
- Check shared-instance, shared-database HTTP deployments with ENABLE_MULTI_TENANT=true; stdio and one-tenant-per-instance deployments are not affected.
- Upgrade n8n-mcp to 2.56.1 or later and confirm its one-time history migration completes.
- Until the update is complete, set DISABLED_TOOLS=n8n_workflow_versions, separate each tenant into its own instance and database, or restrict HTTP access to trusted operators.
- Review cross-tenant history reads or deletions and confirm old unscoped workflow backup rows are identified.
- Restore deleted history when possible and rotate authorization headers, tokens, and credentials if another tenant could read them.
- Restart or redeploy affected services when required, remove temporary artifacts, and keep compensating controls until validation is complete.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm n8n-mcp is 2.56.1 or later and deployment logs show the one-time workflow-history migration completed without errors.
- Confirm the migration cleared previously unscoped backups, then use tenants A and B on one test database and verify neither can list, read, or delete the other's snapshots while each can still use its own history.
- Confirm the multi-tenant HTTP endpoint, database scope, workflow history, and backup access remain isolated for each tenant.
- Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
- Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-54052.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-54052?
n8n-mcp versions listed as affected should be reviewed: < 2.56.1.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.