Missing Authorization in n8n - #VU137164
Published: July 8, 2026
n8n
Detailed vulnerability description
The vulnerability allows a remote user to access and execute another user's protected workflow and disclose sensitive information.
The vulnerability exists due to improper authorization in the OAuth 2.1 consent and token-issuance flow for MCP Server Trigger workflows when processing OAuth resource access requests. A remote user can register an OAuth client, self-approve consent for another user's protected workflow, and obtain a valid token to access and execute another user's protected workflow and disclose sensitive information.
The workflow runs in the owner's project context with the owner's stored credentials, and the resulting executions appear under the owner's account and are not visible to the attacker. Only instances with an active workflow using an MCP Server Trigger node configured with n8n OAuth2 authentication are vulnerable.