PT-2026-114157

CVE-2026-110843

Published

2026-10-14

Updated

2026-10-14

Description by

CVSS 4.0

8.2

High

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1

Description An uncontrolled resource consumption issue exists in the unauthenticated OAuth authorize endpoint. The system resolves clients by URL path but stores the raw identifier of the caller as the record key. Unauthenticated attackers can submit identifiers that differ only in their query string to create an unlimited number of first-party client records. This process bypasses the registration cap and can lead to database growth that eventually fills the disk.

Recommendations Update n8n to version 2.41.4 or later. Update n8n to version 2.42.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Masofgon

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

Related identifiers