n8n CVE-2026-110843

Requires a reachable n8n instance (before 2.41.4, or 2.42.x before 2.42.1) whose unauthenticated OAuth authorize endpoint is exposed to the attacker; the flaw triggers because the endpoint resolves clients by URL path but keys stored records on the caller's raw identifier, so identifiers differing only in query string each create a new first-party client record and bypass the registration cap. No authentication or user interaction is needed (PR:N/UI:N). Exploitation is limited by whether the OAuth endpoint is network-exposed and by the capacity of the backing database/disk - sustained request volume is needed to grow storage until the disk fills, and disk quotas, storage limits, or request rate-limiting would slow or blunt the attack.

This is a genuine availability risk but not a critical, drop-everything priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated vulnerability whose only impact is availability (VA:H; VC:N/VI:N - no confidentiality or integrity loss), consistent with the CWE-770 uncontrolled-resource-consumption / disk-exhaustion described. The AT:P (attack-requirement present) metric signals that exploitation is not entirely unconstrained - it depends on the OAuth authorize flow being reachable and on the backing store/disk being fillable. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the DoS is destructive-but-recoverable rather than a code-execution or data-breach threat. The main caveat: the reported 8.2 is a CVSS 4.0 score, and no equivalent 3.1 score was supplied, so tools consuming 3.1 severities should recompute rather than assume parity. Net: prioritize patching on internet-exposed n8n instances, but treat it below any confidentiality/integrity-impacting flaw.

An unauthenticated attacker who can reach an exposed n8n instance repeatedly calls the OAuth authorize endpoint with identifiers that differ only in their query string. Because the server keys stored client records on the caller's raw identifier, each variant creates a new first-party client record and bypasses the registration cap, so sustained requests grow the database until the disk fills and the service fails. No public exploit was identified at time of analysis, but the attack requires only crafted HTTP requests and no authentication.