Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54052.
Upgrade to ProDetect n8n-MCP Cross-Tenant Workflow Backup Access (CVE-2026-54052) in CrowdStrike LogScale
Detects exploitation of CVE-2026-54052, an authorization bypass (CWE-639/CWE-862) in n8n-mcp <= 2.56.0 HTTP multi-tenant deployments allowing cross-tenant access to workflow version backups. Attackers manipulate tenant/workflow identifiers in backup retrieval requests to read another tenant's stored workflow versions, which may contain embedded credentials, API keys, and webhook secrets.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=HttpRequest
| RequestURI=/(?i)(workflow|backup).*(version|history)/
| RequestURI=/(?i)tenant/
| groupBy([ClientIP], function=([count(as=request_count), collect([RequestURI], as=uris)]))
| filter(request_count>=3)
| sort(request_count, order=desc)Groups HTTP requests to workflow/backup version endpoints with tenant identifiers by client IP over the search window, surfacing clients with 3+ such requests suggestive of cross-tenant backup harvesting.
Data Sources
Required Tables
False Positives & Tuning
- Internal security scanning tools with legitimate multi-tenant access
- Shared corporate proxy or NAT gateway IPs aggregating many users' traffic
- Backup/DR automation systems authorized to touch multiple tenants
Other platforms for CVE-2026-54052
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Cross-tenant backup retrieval via tenant parameter manipulation
Expected signal: HTTP GET request to /api/mcp/workflows/backup/version with tenant_id query parameter that does not match the bearer token's authenticated tenant claim, logged in reverse proxy / application access logs
- Test 2Enumeration of multiple tenant workflow backups
Expected signal: Four or more HTTP requests to the backup/history endpoint from a single source IP within seconds, each carrying a distinct tenant_id value
- Test 3Credential harvesting from exposed workflow backup content
Expected signal: Same cross-tenant HTTP request as the retrieval test, plus process execution logs showing local parsing/grepping of the downloaded backup file for credential-like strings
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54052 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month