CVE-2026-55608

MediumCVSS 5.4/10Last modified Oct 24, 2026

Description

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations. This issue is fixed in version 2.57.4.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-200CWE-863

Affected software

VendorProductVersions
czlonkowskin8n-mcp< 2.57.4

References

Timeline

Published
Jul 15, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-556097.1sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to conscCVE-2026-55616.3A vulnerability was determined in Campcodes Complete POS Management and Inventory System up to 4.0.6. This affects an unknown function of thCVE-2026-556108.7InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior toCVE-2026-556110.0AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 untiCVE-2026-556123.7uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length lCVE-2026-556136.9uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundarieCVE-2026-556146.9uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but comparesCVE-2026-556159.2Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generatedCVE-2026-556176.9Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydroojCVE-2026-556186.5eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informaCVE-2026-556195.3eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informaCVE-2026-55629.8A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/tes