n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
n8n
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-86075
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 8, 2026
- Source last modified
- September 11, 2026
Description
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.
Description quoted from the NVD record.
Who is affected
n8n, a tool for connecting different apps and automating routine tasks, has a flaw in the part that lets other apps register themselves to connect to n8n through a standard sign-in method. This flaw affects versions before 2.37.7 and 2.38.2. Someone on the internet, without logging in, could send that part very large entries over and over, and n8n would save them each time. Over time this could use up all the storage in the database n8n relies on. This flaw is rated High.
What to do
- If someone in your organization installed and runs n8n, that person should check which version is in use.
- If it is a version before
2.37.7or2.38.2, update n8n to2.37.7or2.38.2, the versions that fix this flaw. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- Check the vendor advisory linked on this page for more details about this flaw and its fix.
Analysis written from the source record as of September 11, 2026 and reviewed before publishing.