CVE-2026-110843 n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
Unauthenticated attackers can exhaust disk space by creating unlimited OAuth client records via the authorize endpoint, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110843?
CVE-2026-110843 is a high-severity denial of service vulnerability in n8n-io n8n, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.
Weakness: CWE-770
Which versions are affected by CVE-2026-110843?
How do I fix CVE-2026-110843?
No fix has been published for CVE-2026-110843 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-110843 being exploited?
There is no known exploitation of CVE-2026-110843 in the wild and no public exploit code.
Sources
Also known as GHSA-3qcw-p65v-c7vq, GHSA-8fm5-rv7r-2xfg.