CVE-2026-42236

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1

Description The MCP OAuth client registration endpoint accepts unauthenticated requests and stores client data without adequate resource controls. A remote attacker can exhaust server memory resources by sending large registration payloads, leading to a denial of service that renders the instance unavailable. The endpoint remains reachable even if the MCP enable/disable toggle is used to gate access.

Recommendations Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1.