{"action":"Upgrade n8n-mcp to 2.57.4 or later.","affected":[{"fixed":"2.57.4","introduced":"0"}],"component":"n8n-mcp","cve_ids":["CVE-2026-55608"],"ecosystem":"npm","epss":0.0028,"exploited":false,"fixed_versions":["2.57.4"],"ghsa_id":"GHSA-2cf7-hpwf-47h9","id":"tcs_01M5KESSN7YJ3YCZGHCAT5C70J","modified_at":"2026-07-14T20:41:39.631777Z","published_at":"2026-07-14T20:26:39Z","references":["https://osv.dev/vulnerability/GHSA-2cf7-hpwf-47h9","https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-2cf7-hpwf-47h9","https://github.com/czlonkowski/n8n-mcp/commit/c1ca1e73697feaec5ec2a5fb7e6992a2892b62c9","https://github.com/czlonkowski/n8n-mcp","https://github.com/czlonkowski/n8n-mcp/releases/tag/v2.57.4"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-2cf7-hpwf-47h9","url":"https://osv.dev/vulnerability/GHSA-2cf7-hpwf-47h9"}],"summary":"n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode"}