CVE-2026-110843
8.2HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-770
Impact
Unauthenticated remote attackers can exhaust disk space and crash the instance by flooding the OAuth authorize endpoint with registration requests. They only need network access to the exposed endpoint.
Root cause
The OAuth authorize endpoint resolves client records by URL path but uses the raw caller identifier as the database key, allowing attackers to bypass client caps by varying query parameters.
Affected systems
n8n before 2.41.4 and 2.42.x before 2.42.1
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade n8n to version 2.41.4, 2.42.1, or later; if patching must wait, block or rate-limit unauthenticated access to the OAuth authorize endpoint at your reverse proxy.
$ npm update -g n8nAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.