AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-hh89-3r9w-qj3j: n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint

highvulnerability

security

Source: GitHub Advisory DatabaseSeptember 10, 2026CVE-2026-86075

Summary

n8n, a workflow automation platform, had a vulnerability where unauthenticated attackers could submit extremely large values in OAuth (open authorization, a login system) registration fields without proper size limits, causing the database to grow indefinitely without needing an account. The issue affected the `client_name` and `grant_types` fields, which only had basic existence checks rather than strict size validation like the `redirect_uris` field had.

Solution / Mitigation

The vulnerability is fixed in n8n versions 2.37.7 and 2.38.2 or later. If immediate upgrade is not possible, administrators can: restrict network access to only trusted clients, place the instance behind a reverse proxy (a server that filters traffic) configured to enforce strict request body size limits below the default 16 MiB, and monitor the database size and `oauth_clients` table for unusual entries. The source notes these workarounds do not fully remediate the risk and should only be temporary measures.