CVE-2026-86075 is a high severity denial of service flaw in n8n. The OAuth Dynamic Client Registration endpoint limited redirect URIs but not client names or grant types, so an unauthenticated caller could keep storing huge values and fill the database. Upgrade to 2.37.7 or 2.38.2.
What's affected
- Product: n8n, OAuth Dynamic Client Registration.
- Affected: versions before 2.37.7 and before 2.38.2.
- Fixed: 2.37.7 and 2.38.2, or later. GitHub marks 2.38.2 as a pre-release.
- Privilege needed: none. The advisory says no account is needed.
Severity in the record: High, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The GitHub advisory rates it High, 8.7 under CVSS v4. The record has 7.5 under CVSS v3.1.
Weakness class: CWE-770 (Allocation of Resources Without Limits or Throttling).
How to check if you're exposed
- Find your version. For a global npm install,
n8n --versionprints it. For Docker, rundocker exec my-n8n n8n --version, or read the image tag. - Compare it with the fixed releases for your line, listed above.
- Look at the size of the
oauth_clientstable and at recently added rows with very long names. - Check database disk usage trends for unexplained growth.
What to do now
- Upgrade to 2.37.7, 2.38.2 or later.
- Until then, limit network access so only trusted clients reach the instance.
- Put a reverse proxy in front with strict request body size limits, below the default 16 MiB.
- Monitor database size, and audit the
oauth_clientstable for odd entries, then clean up what you find. - Set a disk usage alert on the database host.
Why it matters
Validation covered one field and skipped two. The patch caps client_name at its column length and limits grant_types to the types the server really supports, with the array capped to that count. The weakness is CWE-770, allocation of resources without limits.
The impact is availability. Repeated registrations grow storage without bound, and since no account is needed the cost to the attacker is tiny. When the database fills, workflows stop. Every public endpoint that stores data needs size limits and, ideally, rate limits. The record does not mark this as exploited in the wild.
Quick check
Is there a quick mitigation besides upgrading?
Yes: restrict network access and set body size limits at a reverse proxy, then monitor and clean the client table. The advisory calls these short term measures.
Sources
Last reviewed: 18 October 2026.
