Open redirect in n8n - CVE-2026-126386
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU163077
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126386
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to redirect visitors from an n8n instance to an arbitrary external destination.
The vulnerability exists due to the default-enabled MCP OAuth registration and authorization endpoints accepting an arbitrary redirect_uri and redirecting visitors before instance checks run. An unauthenticated remote attacker can register an OAuth client and persuade a victim to open a crafted authorization URL, causing the victim's browser to navigate to the attacker-selected destination.
Affected software
n8n
How to mitigate CVE-2026-126386
Install security update from vendor's website.
n8n - addressed in versions 1.123.89, 2.45.5, 2.46.1, 3.0.1