Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

CVE-2026-54052: n8n-MCP multi-tenant deployments let any tenant read and destroy other tenants' workflow backups

AIR-2026-0129 AIR record · 2026-06-n8n-mcp-cross-tenant-backups
Open in dashboard About
From the supporting source
n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deploymentsgithub.com
The record
Disclosed
2026-06-03
Vendor
n8n-mcp maintainers
Product
n8n-mcp (npm)
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Credential theft
System type
Generative model
Who acted
AI was the target — a multi-tenant authorization flaw in the MCP server
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Authenticated tenant request to shared mcp server
Impact type
Cross tenant leakage, Credential disclosure, Data destruction
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI01 – Agent Goal Hijack
MITRE ATLAS
AML.T0048 – External Harms
NIST AI RMF
MEASURE 2.6; MANAGE 1.3
EU AI Act
Annex III §1(c)
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
n8n-mcp <= 2.56.0 running in HTTP mode with ENABLE_MULTI_TENANT=true
Capability abused
workflow_version_history_access
Defense & remediation
Recorded defense
per-tenant scoping, absent on the locally stored workflow version history
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
n8n-mcp 2.56.1
Taxonomy & references
OWASP ASI03 Identity and Privilege AbuseCVE-2026-54052tenant_isolation_failuremcp_multi_tenancycredential_exposure
Curator notes
GHSA-j6r7-6fhx-77wx, CVSS 9.9 Critical, published 2026-06-03. Stored snapshots contain full node definitions, so exposure includes credential references and authorization headers. stdio/single-user and single-tenant HTTP deployments are unaffected. Structurally the same failure as the Asana MCP cross-tenant exposure - the multi-tenant MCP server is emerging as a distinct isolation-failure surface.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-54052: n8n-MCP multi-tenant deployments let any tenant read and destroy other tenants' workflow backups". AIR, AIR-2026-0129. https://agentincident.vercel.app/i/AIR-2026-0129/ (accessed 2026-10-19).