CVE-2026-86075: CVE-2026-86075: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint in n8n

#security #cve #cybersecurity

CVE-2026-86075: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint in n8n

Vulnerability ID: CVE-2026-86075
CVSS Score: 8.7
Published: 2026-09-10

In vulnerable configurations of n8n, the OAuth Dynamic Client Registration endpoint implements field size validation for redirect_uris but fails to enforce proper limits on client_name and grant_types. This allows an unauthenticated remote attacker to submit arbitrarily large values for these fields, leading to persistent database and disk storage exhaustion.

TL;DR

An unauthenticated remote attacker can cause a complete Denial of Service (DoS) of the n8n platform by submitting excessively large registration payloads containing bloated client_name and grant_types fields, which exhausts backend persistent storage.

Technical Details

CWE ID: CWE-770
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS v4.0: 8.7 (High)
Exploit Status: None
KEV Status: Not Listed

Affected Systems

n8n Workflow Automation Platform
n8n: < 2.37.7 (Fixed in: 2.37.7)
n8n: >= 2.38.0, < 2.38.2 (Fixed in: 2.38.2)

Mitigation Strategies

Upgrade n8n to version 2.37.7, 2.38.2, or later
Configure WAF payload limits on registration endpoints
Implement rate limiting per source IP for OAuth registration routes

Remediation Steps:

Identify the deployed n8n version and branch.
If running < 2.37.7, upgrade to 2.37.7.
If running 2.38.0 or 2.38.1, upgrade to 2.38.2.
Monitor database table metrics for the oauth_clients table to detect bloat.

References

Read the full report for CVE-2026-86075 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community