n8n-MCP Multi-Tenant Workflow Backup Scope Isolation Failure

Technical Analysis

n8n-MCP exposes an MCP server that lets AI assistants query and manipulate n8n workflow documentation and version data. When ENABLE_MULTI_TENANT=true, the server failed to properly enforce tenant scoping on workflow_versions backup resources, allowing an authenticated tenant-scoped caller (including an AI agent acting on a tenant's behalf) to read or delete backups belonging to the default/global scope instead of being restricted to their own tenant namespace. This is a broken access control / tenant isolation flaw at the tool layer of an MCP server, meaning any agent with valid but limited credentials could escalate its effective data-access boundary without further exploitation steps. The impact is confined to data exposure and destruction of workflow backups rather than code execution, but in migrated or legacy multi-tenant deployments this could destroy the only available recovery point for critical automation workflows.

Affected Systems

n8n-MCP; protocols: MCP

Detection Signatures

• Requests to workflow_versions or backup-related MCP endpoints referencing tenant IDs other than the caller's own
• Audit logs showing default-scope backup reads/deletes from authenticated non-default tenants
• ENABLE_MULTI_TENANT=true deployments running n8n-MCP versions prior to 2.57.4
• Unexpected deletion or download of legacy/default-scope workflow_versions backups

Remediation Steps

1. 1

   Upgrade n8n-MCP

   Update to n8n-MCP version 2.57.4 or later, which fixes the tenant scoping enforcement for workflow_versions backups.

2. 2

   Audit backup access logs

   Review historical access and deletion logs for workflow_versions backups to identify any cross-tenant access that may have already occurred.

3. 3

   Restrict multi-tenant migrations

   When migrating from single-tenant to multi-tenant deployments, explicitly reassign or purge default-scope backups rather than leaving them accessible under the new multi-tenant configuration.

4. 4

   Enforce least privilege for agent credentials

   Ensure AI assistant/agent credentials used against the MCP server are scoped tightly per tenant and validate that scope enforcement is tested as part of deployment CI/CD.