CVE-2026-42235
Undergoing Analysis Undergoing Analysis - In Progress
Stored XSS in n8n Workflow Automation Platform

Publication date: 2026-05-04

Last updated on: 2026-05-06

Assigner: GitHub, Inc.

Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted client_name. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that access, a toast notification would render the injected script. Clicking the link would execute arbitrary JavaScript in the victim's authenticated n8n browser session, enabling credential and session token theft, workflow manipulation, or privilege escalation. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-04
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-05-05
EPSS Evaluated
2026-06-15
NVD
CVE-2026-42235
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.32 (exc)
n8n n8n 2.18.0
n8n n8n From 2.17.0 (inc) to 2.17.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-87 The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects the n8n workflow automation platform prior to versions 1.123.32, 2.17.4, and 2.18.1. An unauthenticated attacker could register a malicious OAuth client with a specially crafted client_name. If a victim user authorized the OAuth consent dialog and then a second user revoked that access, a toast notification would render the injected script. Clicking the link in this notification would execute arbitrary JavaScript in the victim's authenticated n8n browser session.

This allows the attacker to steal credentials and session tokens, manipulate workflows, or escalate privileges within the n8n platform.

Impact Analysis

The vulnerability can lead to serious security impacts including theft of user credentials and session tokens, unauthorized manipulation of workflows, and privilege escalation within the n8n platform.

An attacker exploiting this vulnerability could gain unauthorized access to sensitive data and perform actions on behalf of the victim user, potentially compromising the integrity and confidentiality of automated workflows.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your n8n installation to one of the patched versions: 1.123.32, 2.17.4, or 2.18.1.

Compliance Impact

The vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript in a victim's authenticated n8n browser session, potentially leading to credential and session token theft, workflow manipulation, or privilege escalation.

Such unauthorized access and data theft could lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.

Therefore, if exploited, this vulnerability could compromise compliance with these standards by exposing sensitive user data and undermining system integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42235. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart