What’s Vulnerable › Vulnerabilities

CVE-2026-110843: n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint

• Severity: high (CVSS 8.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-16
• Weakness: CWE-770

Description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.

Affected products

• n8n-io n8n: before 2.41.4; from 2.42.0 before 2.42.1 — fixed in 2.41.4, 2.42.1

How to fix

Upgrade to a fixed version: n8n-io n8n 2.41.4, 2.42.1. Check the vendor advisory for mitigations.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-3qcw-p65v-c7vq
• https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-unauthenticated-unbounded-oauth-client-persistence-via-authorize-endpoint

Get alerted when CVE-2026-110843 or the next vulnerability affects your stack