GHSA-f6x8-65q6-j9m9: n8n has Open Redirect in MCP OAuth Consent Flow

Summary

n8n's `/mcp-oauth/register` endpoint accepts OAuth client registrations without authentication, so arbitrary `redirect_uri` values can be registered. When a user clicks Deny on the MCP OAuth consent dialog, the `handleDeny` handler redirects them to that registered URI without validation, creating an open redirect. An attacker can send a phishing link that silently sends a victim to an external site after they deny consent.

Mitigation

Fixed in n8n 1.123.32, 2.17.4, and 2.18.1. Upgrade to one of these versions or later. If upgrading is not immediately possible, restrict network access to the n8n instance so untrusted users cannot reach the MCP OAuth endpoints, and limit access to fully trusted users only. The source states these workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmLLM dependency since 2026-02-10

Topics

• Model Context Protocol

Related items

• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
• MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
• MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database