n8n: Uncontrolled resource consumption in unauthenticated OAuth authorize endpoint
Summary
n8n versions before 2.41.4 and 2.42.0 to 2.42.0 (before 2.42.1) are affected. An unauthenticated attacker can send requests to the OAuth authorize endpoint whose identifiers differ only in the query string, which creates unlimited client records that bypass the registration cap. The database grows until the disk is full, which takes the n8n service and all workflows offline. Exploitation requires only network access to the instance and no login.
Affected
- n8n before 2.41.4
- n8n 2.42.0 before 2.42.1
Fixed in
- 2.41.4 (stable)
- 2.42.1 (beta)
- n8n Cloud is patched automatically according to the vendor
Workaround
- Restrict network access to the n8n instance to trusted users and systems only.
- Deactivate or reconfigure workflows that use Form Trigger or Chat Trigger nodes with n8nUserAuth authentication until the instance is patched.
- Monitor database size and set disk usage alerts.
- These measures are temporary and do not fully remediate the risk.
Exploitation
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No known exploitation in the wild and no public proof of concept at the time of research.
- Not listed in the CISA KEV catalog.
Our recommendation
- Identify all n8n instances and their versions, including beta installations.
- Upgrade to n8n 2.41.4 (stable) or 2.42.1 (beta) or later.
- Until patched, restrict access to the instance and check whether it is reachable from the internet.
- Monitor database size and free disk space on exposed systems.
- If an affected instance was internet-reachable, review users, OAuth clients and API keys, check for unknown executions and rotate stored credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3qcw-p65v-c7vq github.com
- VulnCheck Advisory www.vulncheck.com
- n8n Community: Security Update 01 October 2026 community.n8n.io
- OpenCVE CVE-2026-110843 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:12.
Original description (NVD)
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.