CVE-2026-42230

medium

n8n is an open source workflow automation platform.

Vendor / product: N8n — n8n

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /mcp-oauth/register endpoint accepted OAuth client registrations without authentication, allowing arbitrary redirect_uri values to be registered. When a user denies the MCP OAuth consent dialog, the handleDeny handler redirects the user to the registered redirect_uri without validation, enabling an open redirect to an attacker-controlled URL. An attacker can craft a phishing link and send it to a victim; if the victim clicks "Deny" on the consent page, they are silently redirected to an external site. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

CVSS

6.1

6.1 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-05-04 19:16

Modified: 2026-11-11 23:10

NVD status: Analyzed

Last synced 3 hours ago

Verified against the source API 2026-11-11 23:13 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

n8n / n8n <1.123.32, ≥2.17.0 <2.17.4, 2.18.0

Weakness classification (CWE)

CWE-601

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-f6x8-65q6-j9m9

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-f6x8-65q6-j9m9 security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-11-11 23:13 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-42230

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs