n8n CVE-2026-42235

Requires MCP (Model Context Protocol) server functionality enabled in the n8n deployment-this is a specific feature toggle, not default for all installations. OAuth client registration endpoint must be network-accessible to unauthenticated users, which depends on deployment architecture and access controls. Attack requires three distinct user interactions across two different user accounts: (1) attacker successfully registers malicious OAuth client with crafted client_name, (2) first victim user authorizes the OAuth consent dialog for the malicious client, and (3) second user with appropriate privileges revokes that OAuth client access, triggering the vulnerable toast notification. The complex interaction chain (reflected in CVSS AC:H) limits exploitation to targeted scenarios rather than opportunistic mass attacks. Exploitation limited to environments where multiple users actively manage OAuth clients and where revocation workflows are part of operational security practices. Single-user n8n instances or deployments where OAuth client management is restricted to administrators face reduced practical risk despite network accessibility (AV:N).

Real-world risk is elevated but requires careful assessment of exploitation prerequisites. CVSS 8.2 (High) with AV:N/AC:H/PR:N/UI:R/S:C indicates network-accessible attack with high complexity and required user interaction, but no authentication needed and changed scope elevates impact. The AC:H (high complexity) reflects the multi-step attack chain: attacker registers malicious OAuth client, victim1 authorizes it, victim2 revokes it, victim1 clicks the notification link. UI:R (required interaction) means victims must actively click the malicious link in the toast notification. However, the changed scope (S:C) and high confidentiality/integrity impact (C:H/I:H) reflect realistic consequences including credential theft and workflow manipulation in an automation platform that typically handles sensitive API keys and business logic. No EPSS score provided, but exploitation complexity suggests targeted attacks rather than mass scanning. No CISA KEV listing or public POC identified, indicating no confirmed active exploitation. The straightforward nature of XSS exploitation means proof-of-concept development is trivial for skilled attackers, but the specific trigger condition (OAuth revocation by second user) limits opportunistic exploitation. Primary risk is to multi-user n8n deployments with MCP OAuth functionality enabled-single-user instances or deployments without MCP server functionality face minimal risk. Vendor has released patches across three affected version branches with clear remediation guidance.

An external attacker without credentials accesses the publicly exposed n8n MCP OAuth client registration endpoint and registers a malicious OAuth client with a crafted client_name containing JavaScript payload such as <img src=x onerror=alert(document.cookie)> or more sophisticated credential exfiltration code. The attacker socially engineers or waits for a legitimate n8n user (victim1) to review pending OAuth clients and authorize the malicious entry through the consent dialog. Days or weeks later, a different authenticated user (victim2) performing routine security housekeeping revokes the suspicious OAuth client access. This revocation triggers n8n to display a toast notification to victim1 containing the unsanitized client_name, rendering the injected script. When victim1's browser processes the notification, the JavaScript executes within their authenticated session context, exfiltrating session tokens, API credentials stored in workflows, or modifying automation logic to inject backdoors. No public proof-of-concept exists, but XSS exploitation techniques are well-documented and readily adaptable.