CVE-2026-55608 n8n-mcp vulnerability
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations. This issue is fixed in version 2.57.4.
Browse Authorization Bypass security risksQuick answer
n8n-mcp should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- < 2.57.4
Fixed versions
- 2.57.4
How to fix it
n8n-mcp is affected by CVE-2026-55608, a default-scope workflow backup access flaw in multi-tenant HTTP mode. An authenticated tenant can reach legacy or migration backups outside its tenant scope and may read or delete them. Upgrade n8n-mcp to 2.57.4 or later. Prioritize exposed production systems and accounts that can reach the affected feature.
- Inventory every n8n-mcp deployment, version, exposed endpoint, environment, and owner.
- Check shared multi-tenant HTTP deployments with ENABLE_MULTI_TENANT=true and default-scope workflow_versions data; stdio and single-tenant deployments are not affected.
- Upgrade n8n-mcp to 2.57.4 or later.
- Until the update is complete, restrict the HTTP endpoint to trusted operators, use stdio or one tenant per instance, and remove unneeded default-scope legacy backups.
- Review backup list, read, and delete actions for missing tenant context or access to default-scope workflow versions.
- Restore deleted backups when possible and rotate authorization headers or credentials if exposed snapshots contained sensitive values.
- Restart or redeploy affected services when required, remove temporary artifacts, and keep compensating controls until validation is complete.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm n8n-mcp is 2.57.4 or later on every shared multi-tenant HTTP deployment.
- In multi-tenant mode, confirm requests missing x-n8n-url or x-n8n-key fail closed and no tenant can list, read, or delete default-scope backups.
- Confirm the multi-tenant HTTP endpoint, database scope, workflow history, and backup access remain isolated for each tenant.
- Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
- Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-55608.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-55608?
n8n-mcp versions listed as affected should be reviewed: < 2.57.4.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.