CVE-2026-86075

n8n, an open source workflow automation platform, fails to length-cap the client_name and grant_types fields in its OAuth Dynamic Client Registration endpoint (redirect_uris is bounded, but MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES validation is ineffective prior to versions 2.37.7 and 2.38.2). An unauthenticated remote caller can repeatedly submit registration requests with arbitrarily large values, which are persisted to the oauth_clients table. By repeating this, the attacker exhausts database storage and causes a denial of service, with high availability impact but no confidentiality or integrity impact. Any self-hosted n8n deployment running an affected version is affected, with risk concentrated in instances whose HTTP endpoint is reachable by unauthenticated callers, such as internet-exposed servers. There is no known exploitation in the wild, no public proof-of-concept, and EPSS puts 30-day exploitation probability at 0.3% (22nd percentile).

What to do: Upgrade n8n to version 2.37.7 or 2.38.2 (or later) to get the corrected length validation. If upgrading is not immediately possible, restrict unauthenticated access to the instance's HTTP endpoint (e.g., firewall, reverse-proxy rules, or VPN) and monitor growth of the oauth_clients table/database storage for signs of abuse. Administrators should check whether oversized client_name or grant_types entries have already accumulated in oauth_clients.