{"id":"CVE-2026-110843","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-110843","generatedAt":"2026-10-27T23:59:18.254Z","title":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key.","description":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.","published":"2026-10-14T23:17:25.000Z","lastModified":"2026-10-16T18:17:34.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.2,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-770"],"affected":[],"epss":{"score":0.00291,"percentile":0.21494,"date":"2026-10-26","history":[{"date":"2026-10-15","score":0.00291,"percentile":0.20241}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T23:17:25.000Z","detail":{"score":"8.2","severity":"HIGH","publishedAt":"2026-10-14T23:17:24.787Z"},"summary":"New CVE, high severity (CVSS 8.2)."}],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-3qcw-p65v-c7vq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-unauthenticated-unbounded-oauth-client-persistence-via-authorize-endpoint","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-110843","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}