Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54052.
Upgrade to ProDetect n8n-MCP Cross-Tenant Workflow Backup Access (CVE-2026-54052) in Sumo Logic CSE
Detects exploitation of CVE-2026-54052, an authorization bypass (CWE-639/CWE-862) in n8n-mcp <= 2.56.0 HTTP multi-tenant deployments allowing cross-tenant access to workflow version backups. Attackers manipulate tenant/workflow identifiers in backup retrieval requests to read another tenant's stored workflow versions, which may contain embedded credentials, API keys, and webhook secrets.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=web/access
| parse "* * * [*] \"* * *\" * *" as clientip, ident, user, timestamp, method, path, protocol, status, size
| where path matches "*workflow*backup*" or path matches "*backup*version*" or path matches "*version*history*"
| parse regex field=path "(?i)tenant(?:_id|Id)?=(?<tenant_id>[a-zA-Z0-9\-]+)"
| where !isNull(tenant_id)
| timeslice 15m
| count_distinct(tenant_id) as distinct_tenants, count as request_count by clientip, _timeslice
| where distinct_tenants >= 3
| sort -distinct_tenantsDetects clients requesting workflow/backup version endpoints across 3+ distinct tenant IDs within 15-minute windows, indicative of exploitation of the n8n-mcp cross-tenant authorization bypass.
Data Sources
Required Tables
False Positives & Tuning
- Central monitoring tools with legitimate broad tenant visibility
- Batch export jobs run by platform operators across tenants
- CDN or WAF nodes aggregating traffic that appears as a single client IP
Other platforms for CVE-2026-54052
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Cross-tenant backup retrieval via tenant parameter manipulation
Expected signal: HTTP GET request to /api/mcp/workflows/backup/version with tenant_id query parameter that does not match the bearer token's authenticated tenant claim, logged in reverse proxy / application access logs
- Test 2Enumeration of multiple tenant workflow backups
Expected signal: Four or more HTTP requests to the backup/history endpoint from a single source IP within seconds, each carrying a distinct tenant_id value
- Test 3Credential harvesting from exposed workflow backup content
Expected signal: Same cross-tenant HTTP request as the retrieval test, plus process execution logs showing local parsing/grepping of the downloaded backup file for credential-like strings
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54052 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month