CVE-2026-86075

Undergoing Analysis Undergoing Analysis - In Progress

Oversized OAuth Client Registration in n8n

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86075

EUVD

EUVD-2026-74281

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	to 2.37.7 (exc)
n8n	n8n	From 2.38.0 (inc) to 2.38.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-86075 is a high-severity vulnerability in n8n workflow automation software versions prior to 2.37.7 and 2.38.2. It allows unauthenticated remote attackers to exhaust database storage by exploiting the OAuth Dynamic Client Registration endpoint. The vulnerability occurs because the endpoint only validates the size of redirect_uris but accepts arbitrarily large values for client_name and grant_types, which are stored without size limits in the database.

Detection Guidance

Monitor the oauth_clients table in your n8n database for unusually large client_name or grant_types values. Check for rapid database storage growth or unexpected increases in table size. Use database-specific commands like 'SELECT LENGTH(client_name), LENGTH(grant_types) FROM oauth_clients;' to inspect field sizes.

Impact Analysis

This vulnerability can lead to database storage exhaustion, causing service disruption or complete system failure. Attackers could fill up storage without needing an authenticated account, potentially making the n8n instance unusable. It may also allow attackers to manipulate OAuth client registrations for further attacks.

Mitigation Strategies

Upgrade n8n to version 2.37.7 or 2.38.2 immediately. Restrict network access to the OAuth Dynamic Client Registration endpoint. Configure a reverse proxy to enforce request size limits. Monitor database storage and the oauth_clients table for anomalies.

Hi! I’m here to help you understand CVE-2026-86075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70