CVE-2026-110843

{
  "etk_id": "ETK-2026-1671",
  "cve_id": "CVE-2026-110843",
  "display_id": "CVE-2026-110843",
  "ghsa_id": "GHSA-8fm5-rv7r-2xfg",
  "euvd_id": "EUVD-2026-101726",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OAuth endpoint resource exhaustion in n8n",
  "summary": "n8n releases earlier than 2.41.4, and 2.42.x releases earlier than 2.42.1, are affected. An unauthenticated remote attacker can cause excessive client records to accumulate and exhaust database storage through the OAuth authorization endpoint.",
  "mitigation": "Upgrade n8n to version 2.41.4 or, on the 2.42 branch, to 2.42.1. Restrict public access to the OAuth authorization endpoint until the upgrade is complete.",
  "vendor": "n8n-io",
  "product": "n8n",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.41.4",
        ">= 2.42.0, < 2.42.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.41.4",
        "2.42.1"
      ],
      "package_name": "n8n",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": 0.0029,
  "epss_percentile": 0.204,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.58281375,
  "t0_at": "2026-10-14T22:52:18.571000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T22:52:18.571000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T22:52:18.571000+00:00",
      "url": "https://github.com/advisories/GHSA-8fm5-rv7r-2xfg"
    }
  }
}