A significant security flaw has been identified in n8n, the popular open-source workflow automation platform. This vulnerability, tracked as CVE-2026-86075, could allow an unauthorized attacker to disrupt the service by exhausting its database storage, leading to a denial of service.<\/p>\n
The problem lies within n8n\u2019s OAuth Dynamic Client Registration endpoint. While this feature correctly limits the length of redirect Uniform Resource Identifiers (URIs), it did not properly restrict the size of the Product:<\/strong> n8n<\/p>\n Published Date:<\/strong> September 8, 2026<\/p>\n Severity:<\/strong> HIGH<\/p>\n Status:<\/strong> Analyzed<\/p>\n This vulnerability impacts n8n versions prior to 2.37.7 and 2.38.2.<\/p>\n The vulnerability has been thoroughly analyzed by the n8n team. Thankfully, a fix has already been developed and released to address this critical issue.<\/p>\n The vulnerability carries a CVSS score of 7.5, classifying it as a HIGH<\/strong> severity issue. This high rating reflects the potential for an unauthenticated attacker to cause a complete disruption of service, which can severely impact operations that rely on the n8n platform.<\/p>\n The most crucial step to protect your n8n installation from CVE-2026-86075 is to update your software immediately. The n8n team has released patches in versions 2.37.7<\/strong> and 2.38.2<\/strong>. Updating to either of these versions, or any newer release, will implement the necessary validations and prevent unauthorized database exhaustion.<\/p>\n It is always a good practice to keep your software up to date, not just for security reasons but also to benefit from new features and performance improvements. Always back up your data before performing any major updates.<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/releases\/tag\/n8n@2.37.7<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/releases\/tag\/n8n@2.38.2<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/security\/advisories\/GHSA-hh89-3r9w-qj3j<\/p>\n","protected":false},"excerpt":{"rendered":" A significant security flaw has been identified in n8n, the popular open-source workflow automation platform. This vulnerability, tracked as CVE-2026-86075, could allow an unauthorized attacker to disrupt the service by exhausting its database storage, leading to a denial of service. The problem lies within n8n\u2019s OAuth Dynamic Client Registration endpoint. While this feature correctly limits […]<\/p>\n","protected":false},"author":17,"featured_media":3515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[732,785,1067,1239,1068],"class_list":["post-3977","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cybersecurity","tag-denial-of-service","tag-n8n","tag-n8n-platform","tag-workflow-automation"],"blocksy_meta":[],"yoast_head":"\nclient_name<\/code> and grant_types<\/code> fields. This oversight meant that an attacker, even without any form of authentication, could repeatedly send unusually large values to these fields. Such actions would cause the oauth_clients<\/code> table in the database to fill up rapidly, consuming all available storage and making the n8n platform unresponsive.<\/p>\nCVE Details<\/h2>\n
Affected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
References<\/h2>\n