CVE-2026-55608: n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

July 14, 2026

In multi-tenant HTTP mode (ENABLE_MULTI_TENANT=true), an authenticated tenant could, under certain conditions, reach n8n-mcp’s local default-scope workflow_versions backups instead of being confined to its own tenant scope. This affects n8n-mcp’s own local workflow-version storage, not a normal n8n API capability.

References

github.com/advisories/GHSA-2cf7-hpwf-47h9
github.com/czlonkowski/n8n-mcp/commit/c1ca1e73697feaec5ec2a5fb7e6992a2892b62c9
github.com/czlonkowski/n8n-mcp/releases/tag/v2.57.4
github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-2cf7-hpwf-47h9
nvd.nist.gov/vuln/detail/CVE-2026-55608

Code Behaviors & Features

Detect and mitigate CVE-2026-55608 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →