n8n OAuth Endpoint Flaw Allows Unauthenticated Resource Exhaustion in Versions Before 2.41.4

The n8n automation platform contains a security flaw that allows unauthenticated attackers to exhaust server resources. National Vulnerability Database records identify this as CVE-2026-110843, classifying it as a High severity issue with a CVSS score of 8.2. The defect resides in the unauthenticated OAuth authorize endpoint, which resolves clients based on URL paths but stores the caller's raw identifier as the record key. This discrepancy enables attackers to manipulate the registration process without proper credentials.

The risk

Attackers can exploit this weakness by sending requests with identifiers that differ only in their query strings. Because the system treats these as unique records, it creates unlimited first-party client entries. This activity bypasses the standard registration cap designed to limit client creation. As the number of records grows, the database expands continuously until the disk fills. The source material states that this process grows the database until the disk fills, but does not explicitly state that this results in a denial-of-service condition or halts automation workflows.

Who is exposed

According to the National Vulnerability Database, n8n-io n8n versions before 2.41.4 are affected by this vulnerability. Additionally, versions in the 2.42.x branch are vulnerable if they are prior to 2.42.1. Organizations running any earlier release of the software face immediate exposure. Teams must verify their current installation version against these thresholds to determine if their environment is at risk. No other specific software configurations are mentioned in the advisory.

Cost and compliance

The source material does not provide specific details regarding financial costs associated with this vulnerability. There is no mention of regulatory compliance impacts, such as GDPR or HIPAA violations, in the National Vulnerability Database record. The advisory focuses strictly on the technical mechanism of the resource exhaustion and the affected software versions. Organizations must assess their own compliance obligations based on their specific data handling practices and the potential for service interruption.

What to watch

Security operations teams should monitor for unusual spikes in database size or disk usage on servers hosting n8n instances. Watch for a high volume of requests to the OAuth authorize endpoint from unauthenticated sources. Investigate any sudden failure of automation workflows that coincides with storage capacity reaching its limit. These indicators may suggest an ongoing resource exhaustion attack leveraging the identified vulnerability.

Signals worth monitoring

Teams usually detect this type of resource exhaustion by observing rapid growth in database file sizes or unexpected alerts from storage monitoring tools. Check whether log files show a high frequency of requests to OAuth endpoints that lack valid authentication tokens. Look for patterns where request payloads differ only in non-essential parameters like query strings, which often indicates automated abuse. First containment moves typically involve restricting access to the affected endpoint via firewall rules or web application firewalls to stop the influx of malicious requests while a permanent fix is evaluated.

What to do and how to stay safe: n8n

• Verify the current version of n8n running in your environment against the affected ranges listed in the advisory.
• Implement network-level restrictions to limit access to the OAuth authorize endpoint to trusted sources only.
• Monitor disk usage and database growth rates for sudden anomalies that could indicate an active attack.
• Wait for the vendor to release an official update before applying any unverified workarounds to avoid stability issues.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of n8n are vulnerable to CVE-2026-110843?

n8n versions before 2.41.4 and versions 2.42.x before 2.42.1 are affected by this vulnerability.

What is the severity rating of this vulnerability?

The National Vulnerability Database rates CVE-2026-110843 as High severity with a CVSS score of 8.2.

How do attackers exploit this flaw?

Attackers send identifiers that differ only in their query strings to create unlimited client records, bypassing registration caps and filling disk space.