{"data":{"id":"70929cdf-1778-43e8-9ee8-4491eedc8272","title":"GHSA-2cf7-hpwf-47h9: n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode","summary":"n8n-MCP versions up to and including 2.57.3, when run in multi-tenant HTTP mode (ENABLE_MULTI_TENANT=true), let an authenticated tenant reach the local default-scope workflow_versions backups instead of being confined to its own tenant scope. An attacker with tenant access can read or delete these backups, which may contain sensitive workflow configuration; single-tenant and stdio deployments are not affected.","solution":"Upgrade to n8n-mcp 2.57.4 or later. Workarounds: restrict network access to the HTTP endpoint (firewall, reverse proxy or VPN), run in stdio mode, or remove default-scope backups from a prior single-tenant deployment if they are not needed.","labels":["security","privacy"],"sourceUrl":"https://github.com/advisories/GHSA-2cf7-hpwf-47h9","publishedAt":"2026-07-14T20:26:39.000Z","cveId":"CVE-2026-55608","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":["n8n-mcp@<= 2.57.3 (fixed: 2.57.4)"],"affectedPackageNames":["n8n-mcp"],"affectedPackageRefs":["npm:n8n-mcp"],"affectedVendors":[],"affectedVendorsRaw":["n8n-MCP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0028,"epssCheckedAt":"2026-10-15T06:09:21.480Z","kevDateAdded":null,"advisoryAliases":["GHSA-2cf7-hpwf-47h9"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-14T20:26:39.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}