n8n-MCP Cross-Tenant Workflow Backup Access (CVE-2026-54052)

let SuspiciousWindow = 15m;
AppServiceHTTPLogs
| where CsUriStem matches regex @"(?i)/(workflows?|backups?)/(version|history)"
| extend TenantParam = extract(@"(?i)tenant(?:_id|Id)?=([a-zA-Z0-9\-]+)", 1, CsUriQuery)
| extend WorkflowParam = extract(@"(?i)workflow(?:_id|Id)?=([a-zA-Z0-9\-]+)", 1, CsUriQuery)
| where isnotempty(TenantParam)
| summarize DistinctTenants = dcount(TenantParam), TenantList = make_set(TenantParam), RequestCount = count(), URLs = make_set(CsUriStem) by CIp, bin(TimeGenerated, SuspiciousWindow)
| where DistinctTenants >= 3
| project TimeGenerated, CIp, DistinctTenants, TenantList, RequestCount, URLs
| order by DistinctTenants desc

index=web sourcetype=n8n_mcp_http (uri_path="*workflow*" OR uri_path="*backup*") (uri_path="*version*" OR uri_path="*history*")
| rex field=uri_query "(?i)tenant(?:_id|Id)?=(?<tenant_id>[a-zA-Z0-9\-]+)"
| rex field=uri_query "(?i)workflow(?:_id|Id)?=(?<workflow_id>[a-zA-Z0-9\-]+)"
| where isnotnull(tenant_id)
| bucket _time span=15m
| stats dc(tenant_id) as distinct_tenants values(tenant_id) as tenants count as request_count by src_ip, _time
| where distinct_tenants >= 3
| sort -distinct_tenants

sequence by http.client_ip with maxspan=15m
  [network where url.path : ("*workflow*", "*backup*") and url.path : ("*version*", "*history*") and url.query : "*tenant*"]
  [network where url.path : ("*workflow*", "*backup*") and url.path : ("*version*", "*history*") and url.query : "*tenant*"]
  [network where url.path : ("*workflow*", "*backup*") and url.path : ("*version*", "*history*") and url.query : "*tenant*"]

SELECT sourceip, UTF8(payload) AS request_payload, COUNT(*) as request_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%HTTP%'
AND (UTF8(payload) ILIKE '%workflow%backup%' OR UTF8(payload) ILIKE '%backup%version%')
AND UTF8(payload) ILIKE '%tenant%'
GROUP BY sourceip
HAVING COUNT(*) >= 3
LAST 15 MINUTES

_sourceCategory=web/access
| parse "* * * [*] \"* * *\" * *" as clientip, ident, user, timestamp, method, path, protocol, status, size
| where path matches "*workflow*backup*" or path matches "*backup*version*" or path matches "*version*history*"
| parse regex field=path "(?i)tenant(?:_id|Id)?=(?<tenant_id>[a-zA-Z0-9\-]+)"
| where !isNull(tenant_id)
| timeslice 15m
| count_distinct(tenant_id) as distinct_tenants, count as request_count by clientip, _timeslice
| where distinct_tenants >= 3
| sort -distinct_tenants

rule cross_tenant_workflow_backup_access {
  meta:
    author = "df00tech"
    description = "Detects cross-tenant workflow backup access consistent with CVE-2026-54052"
    severity = "CRITICAL"
    cve = "CVE-2026-54052"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /(?i).*(workflow|backup).*(version|history).*tenant.*/
    $e.principal.ip = $ip
  match:
    $ip over 15m
  condition:
    #e >= 3
}

#event_simpleName=HttpRequest
| RequestURI=/(?i)(workflow|backup).*(version|history)/
| RequestURI=/(?i)tenant/
| groupBy([ClientIP], function=([count(as=request_count), collect([RequestURI], as=uris)]))
| filter(request_count>=3)
| sort(request_count, order=desc)