CVE-2026-55608

What it is

CVE-2026-55608 in n8n-MCP (the MCP server exposing n8n node docs and operations to AI assistants), fixed in v2.57.4, published 2026-07-15 and now in "Analyzed" status. The summary already has the mechanism; what the advisory page adds is the severity and the exploitability shape.

Severity

CVSS 3.1 base score 4.2 (MEDIUM), vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. The two details worth acting on:

• AC:H — high attack complexity. Exploitation is not a trivial always-works path; it depends on conditions (the leftover default-scope workflow_versions backups actually existing from a prior single-tenant deployment or migration).
• PR:L — the attacker must already be an authenticated tenant, not anonymous.
• C:L / I:L, A:N — rated low confidentiality and integrity impact despite the "delete" capability, and no availability impact.

This is a low-severity, precondition-dependent bug — useful when triaging it against other work rather than treating "tenant can delete another tenant's backups" as critical.

What to do

Upgrade to v2.57.4. The fix commit is 1f42899749ed0c584fb6b4fd63d75233c3edee59; see also the release tag and advisory GHSA-2cf7-hpwf-47h9. If you cannot upgrade immediately, the exposure only exists when ENABLE_MULTI_TENANT=true in HTTP mode and default-scope workflow_versions backups remain from earlier single-tenant use or a migration — clearing those stale default-scope backups removes the data at risk.