Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54052.
Upgrade to ProDetect n8n-MCP Cross-Tenant Workflow Backup Access (CVE-2026-54052) in Google Chronicle
Detects exploitation of CVE-2026-54052, an authorization bypass (CWE-639/CWE-862) in n8n-mcp <= 2.56.0 HTTP multi-tenant deployments allowing cross-tenant access to workflow version backups. Attackers manipulate tenant/workflow identifiers in backup retrieval requests to read another tenant's stored workflow versions, which may contain embedded credentials, API keys, and webhook secrets.
MITRE ATT&CK
YARA-L Detection Query
rule cross_tenant_workflow_backup_access {
meta:
author = "df00tech"
description = "Detects cross-tenant workflow backup access consistent with CVE-2026-54052"
severity = "CRITICAL"
cve = "CVE-2026-54052"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.target.url = /(?i).*(workflow|backup).*(version|history).*tenant.*/
$e.principal.ip = $ip
match:
$ip over 15m
condition:
#e >= 3
}UDM rule aggregating HTTP requests to workflow/backup version endpoints containing tenant parameters by principal IP, alerting when 3+ such requests occur within a 15-minute window.
Data Sources
Required Tables
False Positives & Tuning
- Authorized platform administrators performing cross-tenant maintenance
- Automated tenant migration or backup validation scripts
- Multiple tenants sharing a common corporate proxy egress IP
Other platforms for CVE-2026-54052
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Cross-tenant backup retrieval via tenant parameter manipulation
Expected signal: HTTP GET request to /api/mcp/workflows/backup/version with tenant_id query parameter that does not match the bearer token's authenticated tenant claim, logged in reverse proxy / application access logs
- Test 2Enumeration of multiple tenant workflow backups
Expected signal: Four or more HTTP requests to the backup/history endpoint from a single source IP within seconds, each carrying a distinct tenant_id value
- Test 3Credential harvesting from exposed workflow backup content
Expected signal: Same cross-tenant HTTP request as the retrieval test, plus process execution logs showing local parsing/grepping of the downloaded backup file for credential-like strings
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54052 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month