CVE-2026-54052 is a critical flaw (CVSS 9.9) in n8n-MCP, the MCP server for n8n documentation and operations. In HTTP mode with ENABLE_MULTI_TENANT=true, workflow version backups were shared across tenants. An authenticated tenant could read or delete another tenant's snapshots. It is fixed in 2.56.1.
What's affected
- n8n-MCP 2.56.0 and earlier, per the GitHub advisory.
- Fixed in 2.56.1. The upgrade runs a one time migration that isolates existing history and clears previously stored, unscoped backups.
- Only HTTP mode with multi-tenancy enabled is affected. stdio and single-user setups, and single-tenant HTTP deployments, are not.
How to check if you're exposed
Check how you start n8n-MCP. If you use stdio, such as a desktop AI client on one machine, you are not in the affected configuration. If you run the HTTP server, look for ENABLE_MULTI_TENANT=true in the environment or compose file. Then confirm the version.
What to do now
- Upgrade to n8n-MCP 2.56.1 or later.
- If you cannot upgrade at once, read the workarounds in the advisory, and consider turning off multi-tenant mode until you can.
- Review the credentials and authorization headers configured on workflow nodes, because stored snapshots can contain credential references and headers. Rotate any that were shared across tenants.
- Tell affected tenants if you cannot rule out cross-tenant reads.
Why it matters
The classes are CWE-639, CWE-862: authorization bypass through a user controlled key, and missing authorization. The version history lived in one shared store that was not scoped to the calling tenant. Any logged in tenant could therefore address another tenant's data.
The score is high because the data in a snapshot can include credential references and headers, and because the attacker could also destroy backups. The record does not mark the CVE as exploited in the wild.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Is the default Claude Desktop setup affected?
No. The advisory says stdio and single-user deployments are not affected.
Sources
- https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-j6r7-6fhx-77wx
- https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.56.1
Last reviewed: 19 October 2026.
