CVE-2026-110843
Last modified
CVE-2026-110843 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-110843?
How severe is CVE-2026-110843?
How do I fix CVE-2026-110843?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110838FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches in…7.5
- CVE-2026-110839FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMA…7.1
- CVE-2026-11084Inappropriate implementation in Password Manager in Google C…6.5
- CVE-2026-110840n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL i…7
- CVE-2026-110841n8n before 2.41.4 and 2.42.0 contains an authorization bypas…6.1
- CVE-2026-110842n8n before 2.41.4 and 2.42.x before 2.42.1 contains a protot…7.7
- CVE-2026-110844n8n before 1.123.83 contains an authorization bypass vulnera…7.2
- CVE-2026-110845n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.…7.7
- CVE-2026-110846n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signat…7
- CVE-2026-110847n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.…7
- CVE-2026-110848n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.…6
- CVE-2026-110849n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cr…7.2
Are you affected by CVE-2026-110843?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST