A significant security flaw has been identified in n8n, the popular open-source workflow automation platform. This vulnerability, tracked as CVE-2026-86075, could allow an unauthorized attacker to disrupt the service by exhausting its database storage, leading to a denial of service.
The problem lies within n8n’s OAuth Dynamic Client Registration endpoint. While this feature correctly limits the length of redirect Uniform Resource Identifiers (URIs), it did not properly restrict the size of the client_name and grant_types fields. This oversight meant that an attacker, even without any form of authentication, could repeatedly send unusually large values to these fields. Such actions would cause the oauth_clients table in the database to fill up rapidly, consuming all available storage and making the n8n platform unresponsive.
CVE Details
Product: n8n
Published Date: September 8, 2026
Severity: HIGH
Status: Analyzed
Affected Products
This vulnerability impacts n8n versions prior to 2.37.7 and 2.38.2.
Current Status
The vulnerability has been thoroughly analyzed by the n8n team. Thankfully, a fix has already been developed and released to address this critical issue.
Severity Level
The vulnerability carries a CVSS score of 7.5, classifying it as a HIGH severity issue. This high rating reflects the potential for an unauthenticated attacker to cause a complete disruption of service, which can severely impact operations that rely on the n8n platform.
Possible Solutions
The most crucial step to protect your n8n installation from CVE-2026-86075 is to update your software immediately. The n8n team has released patches in versions 2.37.7 and 2.38.2. Updating to either of these versions, or any newer release, will implement the necessary validations and prevent unauthorized database exhaustion.
It is always a good practice to keep your software up to date, not just for security reasons but also to benefit from new features and performance improvements. Always back up your data before performing any major updates.
References
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
https://github.com/n8n-io/n8n/security/advisories/GHSA-hh89-3r9w-qj3j
