CVE-2026-110843

Deferred Deferred - Pending Action

Unauthenticated OAuth Resource Exhaustion in n8n

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110843

EUVD

EUVD-2026-101726

Affected Vendors & Products

Vendor	Product	Version / Range
n8n-io	n8n	0
n8n-io	n8n	2.42.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

n8n versions before 2.41.4 and 2.42.x before 2.42.1 have an uncontrolled resource consumption issue in the unauthenticated OAuth authorize endpoint. The vulnerability allows attackers to exploit how clients are resolved by URL path while storing raw identifiers as record keys. By sending identifiers that differ only in their query string, attackers can create unlimited first-party client records, bypassing registration limits and causing database growth until disk space is exhausted.

Detection Guidance

Check for excessive database growth or unusual OAuth client registrations by monitoring disk usage and querying the database for duplicate client records with varying query strings. Look for unauthorized OAuth authorize endpoint requests in logs.

Impact Analysis

This vulnerability can lead to denial of service by filling up disk space, disrupting n8n service operations. It may also allow unauthorized access to OAuth functionality if the system becomes unstable or if attackers manipulate client records. Organizations using affected n8n versions risk service outages and potential data loss due to resource exhaustion.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that violate availability requirements in GDPR and HIPAA. Data loss from disk exhaustion may lead to breaches of integrity or confidentiality. Organizations may fail to meet uptime or data protection obligations, potentially resulting in regulatory penalties or loss of certification.

Mitigation Strategies

Upgrade n8n to version 2.41.4 or later (or 2.42.1 for 2.42.x). Restrict access to the OAuth authorize endpoint via firewall or network policies. Monitor and clean up any unauthorized client records in the database.

Hi! I’m here to help you understand CVE-2026-110843. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70