CVE-2026-86075: n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in oauthclients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAXCLIENTNAMELENGTH and MAXGRANTTYPES. This issue is fixed in versions 2.37.7 and 2.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2
Event History
Frequently Asked Questions
Which deployments are exposed?
n8n versions before 2.37.7 and 2.38.2 are affected if their OAuth Dynamic Client Registration endpoint is reachable by unauthenticated remote callers.
What does an attacker need to exploit this issue?
An attacker does not need authentication. They need remote access to repeatedly submit dynamic client-registration requests containing oversized client_name or grant_types values.
What is the impact of successful exploitation?
Oversized registration values can be persistently stored in the oauth_clients database table. Repeated requests can exhaust available database storage.
What should be done if the instance cannot be upgraded immediately?
The provided information identifies the unauthenticated OAuth Dynamic Client Registration endpoint as the attack path. Restricting unauthenticated remote access to that endpoint can reduce exposure until upgrading to 2.37.7 or 2.38.2.
How can operators look for possible exploitation?
Review the oauth_clients table for unusually large client_name or grant_types values and investigate unexpected growth in database storage associated with OAuth client registrations.