Dashboard / CVE-2026-54052

CVE-2026-54052

CRITICAL
INFO Priority: 0.04 BB Relevance: 70/100
Published: 2026-07-15 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Changed
C: High
I: High
A: Low

Description

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destroy other tenants' stored backups, including full node definitions, credential references, and authorization headers. This issue is fixed in version 2.56.1.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
n8n-mcp n8n-mcp < 2.56.1

References & Advisories (2)

Bug Bounty Relevance

70 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

EPSS — Exploitation Probability

0.39%
Raw Score 0.003880
Percentile 32.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00388
2026-10-28
0.00388

Intelligence Sources

nvd ref →

External Links