Input validation error in n8n - #VU146805
Published: September 2, 2026
Vulnerability identifier: #VU146805
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in OAuth Dynamic Client Registration endpoints when handling client registration requests. A remote attacker can submit excessively large values in the client_name or grant_types fields to cause a denial of service.
The issue results in persistent growth of stored data because the oversized values are written to the database.
Affected software
n8n
Remediation
Install security update from vendor's website.
n8n - addressed in versions 2.37.7, 2.38.2