PT-2026-58933 · Npm · N8N-Mcp
Published
2026-07-14
·
Updated
2026-07-14
CVSS v3.1
4.2
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
Summary
In multi-tenant HTTP mode (
ENABLE MULTI TENANT=true), an authenticated tenant could, under certain conditions, reach n8n-mcp's local default-scope workflow versions backups instead of being confined to its own tenant scope. This affects n8n-mcp's own local workflow-version storage, not a normal n8n API capability.Impact
An authenticated MCP HTTP tenant could read or delete workflow-version backups stored in the default (single-tenant) scope — for example backups left from a prior single-tenant deployment or a migration period. Workflow snapshots may contain sensitive workflow configuration depending on their contents. Single-tenant and stdio deployments are not affected.
Affected versions
<= 2.57.3Patched version
2.57.4Remediation
Upgrade to n8n-mcp
2.57.4 or later. The fix requires a complete tenant context in multi-tenant mode and fails closed for workflow-version access that cannot be attributed to a specific tenant.Workarounds
- Restrict network access to the HTTP endpoint (firewall / reverse proxy / VPN) so only trusted callers can reach it.
- Run in stdio mode, which has no multi-tenant HTTP surface.
- If default-scope backups from a prior single-tenant deployment are not needed, removing them eliminates the exposure.
Credit
Reported by @DavidCarliez.
Fix
Incorrect Authorization
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
N8N-Mcp