CVE-2026-86075 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances, particularly those with exposed or internet-facing deployments, should assess exposure and prioritize updating to fixed versions. They should also review and monitor database storage usage for n8n instances and implement compensating controls to limit unauthenticated remote access. Additionally, defenders should verify n8n instance versions and track exceptions, retest remediated assets, and close the item only n8n

Why it matters

CVE-2026-86075 allows unauthenticated remote callers to persist oversized values in oauth_clients and exhaust database storage in n8n workflow automation platform versions prior to 2.37.7 and 2.38.2. Defenders should prioritize verifying and updating n8n instances, monitoring database storage usage, and implementing compensating controls.

• Potential database storage exhaustion due to oversized client_name and grant_types values
• Verification of n8n instance versions and database storage usage is necessary
• Implementing compensating controls to limit unauthenticated remote access may be required

Technical summary

The OAuth Dynamic Client Registration endpoint in n8n versions prior to 2.37.7 and 2.38.2 bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. This issue is related to packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. The affected validation allows large values to be stored, potentially leading to database storage exhaustion.

Defensive priority

Defenders should prioritize verifying and updating n8n instances to versions 2.37.7 or 2.38.2 to prevent potential database storage exhaustion.

Recommended defensive actions

• Verify n8n instance versions and update to 2.37.7 or 2.38.2 if necessary
• Review and monitor database storage usage for n8n instances
• Implement compensating controls to limit unauthenticated remote access to n8n instances
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. However, the corpus does not establish evidence of exploitation or specific impact. The vulnerability affects n8n workflow automation platform versions prior to 2.37.7 and 2.38.2. There is no information on in-the-wild exploitation. Defenders should verify n8n instance versions and monitor database storage usage. The CVE record was published on 2026-09-08T22:19:16.250Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.