n8n: Unauthenticated Persistent Storage Exhaustion

Published September 10, 2026 CVE-2026-86075

An n8n flaw lets an unauthenticated remote caller fill the instance's database with oversized registration data. That can exhaust storage and affect n8n's availability.

Severity
HighCVSS 4.0 · 8.7
Fix
Fixed in 2.37.7Fix recorded today
Affected versions
before 2.37.7; 2.38.0 or newer, but before 2.38.2
Weakness
CWE-770Allocation of Resources Without Limits
Exploit likelihood
0.29% in 30 daysEPSS, higher than 22% of known flaws
Affects
n8n

How it works

  • An unauthenticated remote caller sends oversized values through n8n's OAuth client-registration endpoint.
  • The endpoint limits redirect addresses but accepts arbitrarily large client names and requested grant types. n8n saves those values in its database.
  • Repeated registrations can grow persistent storage without limit.

What to do

Run npm list n8n in the environment hosting n8n and compare the installed version with the affected ranges in the n8n advisory. Versions below 2.37.7 and versions 2.38.0 through 2.38.1 are affected.

Run this in the application environment you want to check:

npm list n8n

Upgrade n8n to version 2.37.7 or 2.38.2, or any later release.

Technical details

CVE-2026-86075 affects n8n's OAuth Dynamic Client Registration endpoint. Unauthenticated network requests can persist arbitrarily large client_name and grant_types values in oauth_clients, exhausting database storage. The fix limits those values.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source