CVE-2026-110843GHSA-3qcw-p65v-c7vq
n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
n8n-io n8nFrameworks
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.
Text from CVE List
Affected versions 2
- n8naffected: all versions before 2.41.4CVE List
- n8naffected: 2.42.0 before 2.42.1CVE List