CVE-2026-110843: n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.41.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.42.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to reach the n8n OAuth authorize endpoint can exploit it. No prior account or OAuth client registration is required.
What is required to trigger the database growth?
An attacker sends OAuth client identifiers that resolve to the same URL path but differ in their query strings. Each raw identifier can be persisted as a separate first-party client record, bypassing the registration cap.
What is the impact if exploitation continues?
The attacker can create an unlimited number of persisted client records, causing database growth until available disk space is exhausted.
Which versions need remediation?
n8n versions before 2.41.4 are affected, as are 2.42.x versions before 2.42.1. Updating to 2.41.4 or 2.42.1 addresses the affected version ranges.