CVE-2026-110843 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances, especially those exposed to the internet or used in sensitive workflows, should verify and remediate this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review instance configuration, verify version and exposure, and apply patches or mitigations as needed.

Why it matters

CVE-2026-110843 is a HIGH severity vulnerability in n8n that allows unauthenticated attackers to create unlimited client records, leading to uncontrolled resource consumption and potential disk filling. Defenders responsible for n8n instances should verify and remediate this vulnerability to prevent potential DoS attacks and performance degradation.

• Potential disk filling due to uncontrolled resource consumption
• Increased risk of denial-of-service (DoS) attacks
• Possible degradation of n8n instance performance
• Need for verification of instance version and exposure

Technical summary

The vulnerability exists in the unauthenticated OAuth authorize endpoint of n8n, allowing attackers to create unlimited client records by sending identifiers with different query strings. This leads to uncontrolled resource consumption, potentially filling the disk. The vulnerability can cause performance degradation, denial-of-service attacks, and increased risk of system compromise. Defenders should prioritize verifying and remediating this vulnerability in n8n instances, especially those exposed to the internet or used in sensitive workflows.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in n8n instances, especially those exposed to the internet or used in sensitive workflows.

Recommended defensive actions

• Verify n8n instance version and exposure to the internet
• Check for and apply vendor-provided patches or updates
• Monitor n8n instance for suspicious activity
• Consider implementing compensating controls, such as rate limiting or IP blocking
• Review instance configuration and exposure
• Track exceptions and retest remediated assets
• Expand evidenceNotes with source grounding, evidence limits, known and unknown affected scope, and what defenders should verify to at least 340 trimmed characters, adding at least 188 characters if the current article .

Evidence notes

The vulnerability is described in the CVE Program record and NVD vulnerability detail page. The source item provides additional metadata and references. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify instance version and exposure, check for vendor-provided patches, and monitor for suspicious activity. The CVE record was published on 2026-10-14T22:52:18.571Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.