n8n-mcp backup access after n8n key revocation advisory

Evidence record

Maintainer disclosure of stale backup permissions after source API-key revocation.

Read the original source ↗

Claim-level citations (2)

• supportsn8n-mcp workflow backups remained accessible after source API-key revocation: The n8n-mcp advisory describes locally stored workflow backup access continuing after its associated source n8n API key was revoked, without restoring privileges to the live n8n server.

  GHSA-74hp-7jv7-vx4j: local backup access checks, key revocation and patched release

• supportsn8n-mcp workflow backups remained accessible after source API-key revocation: The n8n-mcp local workflow-backup authorization reused the original n8n API-key value as a lasting access identity without checking whether that key was still valid. An actor must possess a formerly valid key and request backup data from the affected adapter; this does not mean the key still grants access to the live n8n API. The revoked key could continue listing, reading or deleting retained local backup versions until their separate retention or authorization expired.

  GHSA-74hp-7jv7-vx4j: local backup access checks, key revocation and patched release