CVE-2026-110843

Executive Summary

CVE-2026-110843 is an uncontrolled resource consumption vulnerability (CWE-770) affecting the n8n workflow automation platform prior to versions 2.41.4 and 2.42.1. The flaw resides in the unauthenticated OAuth authorize endpoint, which resolves OAuth clients by URL path but persists the caller-supplied raw identifier as the primary record key, allowing unauthenticated attackers to create unlimited first-party client records that bypass the intended registration cap. Successful exploitation causes unbounded database growth that ultimately exhausts disk space, degrading or halting the n8n instance and any dependent automation workflows.

Technical Analysis

The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). According to the NVD description, the affected component is the unauthenticated OAuth authorize endpoint of n8n. The core defect is a mismatch between two identifiers used during OAuth client processing:

1. Resolution vs. storage inconsistency. The endpoint resolves an OAuth client by its URL path segment, but when persisting state it stores the caller's raw identifier as the record key. Because these two identifiers are decoupled, an attacker can vary the identifier without changing the path-resolved client.

2. Registration cap bypass. n8n enforces a cap on the number of first-party client records. Because the record key is derived from attacker-controlled input (the raw identifier rather than the canonical path-resolved client), each distinct identifier produces a new persisted record. The cap — which presumably counts canonical clients — does not apply to these attacker-generated duplicates.

3. Unbounded insertion via query string. The NVD description states attackers send "identifiers differing only in their query string." Since the query string is not part of the canonical URL path used for resolution but is retained in the stored raw identifier, each unique query string yields a unique record key. This provides an effectively unlimited namespace of insertable keys.

The practical consequence is a write amplification primitive: a single repeated request against a public, unauthenticated endpoint with a trivially mutated query string produces unbounded rows in the backing datastore. No authentication, no valid client credentials, and no user interaction are required.

The exact datastore technology, the schema of the client registry table, the specific registration cap value, and the exact code path are not disclosed in the NVD description provided. Those details should be confirmed against the n8n source at the patched version before drawing implementation-level conclusions.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. No function names, file paths, or parameter identifiers beyond those in the NVD text are asserted.

1. Reconnaissance / target identification An attacker scans for internet-exposed n8n instances. n8n is commonly deployed on self-hosted infrastructure and exposed for webhook ingestion, which frequently places the OAuth authorize endpoint on the public attack surface. Fingerprinting relies on the n8n web interface, favicon hash, or response characteristics of the OAuth authorize path.

2. Triggering the flaw class The attacker issues unauthenticated HTTP requests to the OAuth authorize endpoint. Each request carries an identifier that differs only in its query string. The endpoint resolves the client by URL path — which remains constant — but stores the caller's raw identifier (including the varying query string) as the record key. Because the key is attacker-controlled and the namespace is unbounded, each request creates a new first-party client record.

3. Payload / execution method At the vulnerability-class level, this is a resource-exhaustion attack driven by high-volume, low-cost HTTP requests. There is no memory-corruption payload, no injection string, and no authentication bypass required — the "payload" is simply a mutated query string per request. The attacker scales request volume to maximize insertion rate.

4. Post-exploitation impact Sustained request volume causes continuous database growth. As the datastore expands, disk consumption rises until storage is exhausted, at which point database writes fail and the n8n instance becomes unresponsive or crashes. Because the records bypass the registration cap, legitimate cleanup or cap-based controls do not bound the growth. Recovery may require manual database pruning, which can itself be expensive on a large, bloated table.

Impact Assessment

• Confidentiality (C:N): No data disclosure is described.
• Integrity (I:N): No record modification of legitimate data is described; the impact is additive record creation.
• Availability (A:H): The primary impact — disk exhaustion renders the platform unavailable.
• Attack Vector (AV:N): Exploitable remotely over the network.
• Attack Complexity (AC:L): The mechanism is straightforward and requires only repeated HTTP requests.
• Privileges Required (PR:N): The endpoint is explicitly unauthenticated.
• User Interaction (UI:N): No victim interaction is required.

Business impact. n8n is an automation orchestration platform. An outage halts scheduled workflows, webhook-driven integrations, and any downstream systems that depend on those workflows. A filled disk can also affect co-located services on the same host or volume. Blast radius scales with how much of an organization's integration and data-pipeline logic is centralized in n8n. Organizations running n8n on small or shared volumes are at elevated risk. Because exploitation is unauthenticated and low-complexity, the barrier to entry for a denial-of-service attempt is minimal.

EPSS is 0.00291 (20.2nd percentile), indicating low predicted near-term exploitation probability. There is no CISA KEV listing and no known in-the-wild exploitation as of this report.

Detection Guidance

Sigma Rule

title: n8n OAuth Authorize Endpoint Excessive Client Record Creation
id: 8f1c2a44-1d7e-4a2b-9c3e-5b6f7a8d9e01
status: experimental
description: Detects high-volume requests to the n8n OAuth authorize endpoint with varying query strings, consistent with CVE-2026-110843 resource exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110843
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1499
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/oauth/authorize'
  selection_query:
    cs-uri-query|contains: 'client_id'
  condition: selection_endpoint and selection_query
  timeframe: 5m
  # Correlate: alert when unique_count(cs-uri-query) for this stem exceeds threshold
fields:
  - c-ip
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate OAuth clients retrying with varied state parameters
level: medium

YARA Rule

rule CVE_2026_110843_n8n_OAuth_Resource_Exhaustion
{
    meta:
        description = "Detects n8n OAuth authorize endpoint abuse artifacts in web/proxy logs (CVE-2026-110843)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110843"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $auth = "/oauth/authorize" ascii wide nocase
        $cid  = "client_id=" ascii wide nocase
        $qs   = "?client_id=" ascii wide nocase
        $amp  = "&" ascii

    condition:
        $auth and ($cid or $qs) and #auth > 0
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110843 n8n OAuth authorize endpoint abuse - potential resource exhaustion"; flow:established,to_server; http.uri; content:"/oauth/authorize"; http.uri; content:"client_id="; threshold:type both, track by_src, count 50, seconds 60; classtype:attempted-dos; reference:cve,2026-110843; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110843; sid:2026110843; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where url.path : "/oauth/authorize" and url.query : "*client_id*"] with runs=50

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%/oauth/authorize%") AND like(uri_query, "%client_id=%")
| stats count AS requests, dc(uri_query) AS unique_queries BY clientip, uri_path
| where requests > 100 AND unique_queries > 50
| sort - unique_queries

Wazuh OSSEC Rule

<group name="n8n,web,attack,">
  <rule id="100843" level="10" frequency="50" timeframe="60">
    <if_matched_sid>31101</if_matched_sid>
    <match>/oauth/authorize</match>
    <match>client_id=</match>
    <description>CVE-2026-110843: Possible n8n OAuth authorize resource exhaustion - excessive client record creation requests.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,resource_exhaustion,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The OSV entry lists affected packages as unfixed at the referenced hashes; the version fix (2.41.4 / 2.42.1) should be independently validated against the n8n release notes before relying on it.

1. Immediate mitigations (no patch applied):

• Remove public exposure of the OAuth authorize endpoint. Place n8n behind a reverse proxy or WAF and restrict /oauth/authorize to trusted networks or known client sources.
• Apply rate limiting at the proxy layer keyed on source IP and on the authorize path, with strict thresholds; reject requests whose query strings vary abnormally per source.
• Enforce a maximum client-record cap at the database layer, independent of application logic, to bound growth if the application control is bypassed.
• Alert on datastore size growth rate and set disk-space alarms at the host and volume level.

2. Patch / upgrade:

• Upgrade to n8n 2.41.4 or 2.42.1 (or later) per the version data. Because the patch is CLAIMED from a single source (OSV), verify the fix in the n8n changelog and confirm the endpoint's identifier handling has been corrected (path-resolved client used as the record key).
• After upgrading, audit the first-party client registry for attacker-created duplicate records and prune them.

3. Long-term hardening:

• Treat the OAuth authorize endpoint as untrusted-input surface: never use raw caller-supplied identifiers as datastore keys; canonicalize to the path-resolved client before persistence.
• Enforce resource quotas on all unauthenticated endpoints, including per-source and global insertion caps with monitoring.
• Adopt defense-in-depth for availability: disk quotas, database size limits, and circuit breakers that disable record creation when thresholds are approached.
• Maintain a vulnerability management cadence that tracks n8n advisories and validates claimed patches before closing findings.

References

• NVD — CVE-2026-110843: https://nvd.nist.gov/vuln/detail/CVE-2026-110843
• OSV — package advisory reference for CVE-2026-110843 (patch source, CLAIMED)
• n8n official release notes / changelog for versions 2.41.4 and 2.42.1 (verify fix)
• MITRE CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE as of this report. EPSS 0.00291; not listed in CISA KEV; no public PoC or Nuclei template available.