Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54052.
Upgrade to ProDetect n8n-MCP Cross-Tenant Workflow Backup Access (CVE-2026-54052) in IBM QRadar
Detects exploitation of CVE-2026-54052, an authorization bypass (CWE-639/CWE-862) in n8n-mcp <= 2.56.0 HTTP multi-tenant deployments allowing cross-tenant access to workflow version backups. Attackers manipulate tenant/workflow identifiers in backup retrieval requests to read another tenant's stored workflow versions, which may contain embedded credentials, API keys, and webhook secrets.
MITRE ATT&CK
QRadar Detection Query
SELECT sourceip, UTF8(payload) AS request_payload, COUNT(*) as request_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%HTTP%'
AND (UTF8(payload) ILIKE '%workflow%backup%' OR UTF8(payload) ILIKE '%backup%version%')
AND UTF8(payload) ILIKE '%tenant%'
GROUP BY sourceip
HAVING COUNT(*) >= 3
LAST 15 MINUTESAggregates HTTP requests containing workflow/backup version and tenant parameters by source IP, surfacing hosts issuing 3+ requests in a 15-minute window consistent with cross-tenant backup enumeration.
Data Sources
Required Tables
False Positives & Tuning
- Shared egress IP for multiple legitimate tenant admins
- Vulnerability scanners authorized for compliance testing generating similar traffic
- Third-party integration platforms polling multiple tenant backups on behalf of customers
Other platforms for CVE-2026-54052
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Cross-tenant backup retrieval via tenant parameter manipulation
Expected signal: HTTP GET request to /api/mcp/workflows/backup/version with tenant_id query parameter that does not match the bearer token's authenticated tenant claim, logged in reverse proxy / application access logs
- Test 2Enumeration of multiple tenant workflow backups
Expected signal: Four or more HTTP requests to the backup/history endpoint from a single source IP within seconds, each carrying a distinct tenant_id value
- Test 3Credential harvesting from exposed workflow backup content
Expected signal: Same cross-tenant HTTP request as the retrieval test, plus process execution logs showing local parsing/grepping of the downloaded backup file for credential-like strings
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54052 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month