AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-j6r7-6fhx-77wx: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

criticalvulnerability

security

Source: GitHub Advisory DatabaseJuly 14, 2026CVE-2026-54052

Summary

In n8n-MCP (a tool for connecting AI models to workflows), multi-tenant HTTP deployments (where one server serves multiple separate user groups) did not properly isolate workflow version backups. This meant an authenticated user from one tenant could read, delete, or destroy backup snapshots belonging to other tenants, potentially exposing sensitive information like credentials and authorization headers stored in those backups.

Solution / Mitigation

Upgrade to version 2.56.1, which isolates stored version history per instance so tenants can only access their own backups. The upgrade runs a one-time migration to isolate existing history and clear previously un-scoped backups. If immediate upgrade is not possible, users can disable the workflow version tool by setting `DISABLED_TOOLS=n8n_workflow_versions` in the server environment (for example, in your Docker `.env` file), or run each tenant from a separate instance with its own database instead of multi-tenant mode, or restrict network access to the HTTP endpoint to trusted operators only.