{"data":{"id":"76b16080-c61d-4250-a4f8-75165862ca5a","title":"GHSA-49m9-pgww-9vq6: n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration","summary":"The MCP OAuth client registration endpoint in n8n accepted unauthenticated requests and stored client data without adequate resource controls. A remote attacker can exhaust server memory with large registration payloads, making the instance unavailable, and the endpoint remains reachable even when MCP is disabled.","solution":"Fixed in n8n 1.123.32, 2.17.4, and 2.18.1; upgrade to one of these versions or later. If upgrading is not immediately possible, restrict network access to the n8n instance to untrusted sources and lower the N8N_PAYLOAD_SIZE_MAX environment variable from its default value. These workarounds do not fully remediate the risk and are short-term measures only.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-49m9-pgww-9vq6","publishedAt":"2026-04-29T21:19:07.000Z","cveId":"CVE-2026-42236","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0, < 2.17.4 (fixed: 2.17.4)","n8n@>= 2.18.0, < 2.18.1 (fixed: 2.18.1)","n8n@< 1.123.32 (fixed: 1.123.32)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n","MCP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00487,"epssCheckedAt":"2026-11-09T18:09:52.268Z","kevDateAdded":null,"advisoryAliases":["GHSA-49m9-pgww-9vq6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-29T21:19:07.000Z","fixReleasedAt":"2026-04-22T06:25:44.105Z","daysToFix":-7,"fixCheckedAt":"2026-10-29T21:37:13.322Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"2.18.1","matchedVersion":"2.18.1","fixReleasedAt":"2026-04-22T06:58:17.570Z","daysToFix":-7,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:13.175Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.17.4","matchedVersion":"2.17.4","fixReleasedAt":"2026-04-22T07:16:24.418Z","daysToFix":-7,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:13.175Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"1.123.32","matchedVersion":"1.123.32","fixReleasedAt":"2026-04-22T06:25:44.105Z","daysToFix":-7,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:13.175Z"}]}}