●PocketClawAI security alerts
Sign in
mediumCVSS 4.2NVD status: Analyzed

CVE-2026-55608

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.

Componentn8n
Severitymedium (CVSS 4.2)
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Published (NVD)2026-07-15
Last modified2026-07-17
Affected versions
n8n-mcp < 2.57.4
Fixed in2.57.4
WeaknessCWE-200CWE-863
CISA KEVnot listed

NVD description

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations. This issue is fixed in version 2.57.4.

Does CVE-2026-55608 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for n8n.
Check my stack

What to do

  • Upgrade n8n to 2.57.4 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other n8n CVEs

high
CVE-2026-103247CVSS 8.5

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper gua...

n8n
2026-10-01high
CVE-2026-103249CVSS 7.6

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerabilit...

n8n
2026-10-01critical
CVE-2026-103255CVSS 9

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase...

n8n
2026-10-01high
CVE-2026-103246CVSS 7.7

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attac...

n8n
2026-10-01critical
CVE-2026-103248CVSS 9

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supaba...

n8n
2026-10-01high
CVE-2026-103250CVSS 8.1

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB...

n8n
2026-10-01

All n8n CVEs