CVE-2026-86075: n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
Impact
The OAuth Dynamic Client Registration endpoints validated field sizes only for redirecturis, leaving clientname and granttypes bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database. Repeated registration therefore grew persistent storage without limit and without any account on the instance. The patch caps clientname at its column length and limits granttypes to the grant types the server actually implements, with the array capped at that count.
Patches
The issue has been fixed in n8n versions 2.37.7 and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict network access to the n8n instance so that only trusted clients can reach it. - Place the instance behind a reverse proxy configured to enforce strict request body size limits below the default 16 MiB. - Monitor database size for unexpected growth and audit the oauthclients table for anomalous entries.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in oauthclients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAXCLIENTNAMELENGTH and MAXGRANTTYPES. This issue is fixed in versions 2.37.7 and 2.38.2.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Configuration
Place the n8n instance behind a reverse proxy configured to enforce strict request body size limits below the default 16 MiB.
n8n (behind reverse proxy) client request body size limit = below default 16 MiB - Compensating control
Restrict network access to the n8n instance so that only trusted clients can reach it.
- Operational
Monitor database size for unexpected growth and audit the oauth_clients table for anomalous entries.
Event History
Frequently Asked Questions
Which deployments are exposed?
n8n versions before 2.37.7 and 2.38.2 are affected if their OAuth Dynamic Client Registration endpoint is reachable by unauthenticated remote callers.
What does an attacker need to exploit this issue?
An attacker does not need authentication. They need remote access to repeatedly submit dynamic client-registration requests containing oversized client_name or grant_types values.
What is the impact of successful exploitation?
Oversized registration values can be persistently stored in the oauth_clients database table. Repeated requests can exhaust available database storage.
What should be done if the instance cannot be upgraded immediately?
The provided information identifies the unauthenticated OAuth Dynamic Client Registration endpoint as the attack path. Restricting unauthenticated remote access to that endpoint can reduce exposure until upgrading to 2.37.7 or 2.38.2.
How can operators look for possible exploitation?
Review the oauth_clients table for unusually large client_name or grant_types values and investigate unexpected growth in database storage associated with OAuth client registrations.