PT-2026-36906 · N8N · N8N

Ori-Ron · Published 2026-04-22 · Updated 2026-05-13 · CVE-2026-42236

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1

Description The MCP OAuth client registration endpoint accepts unauthenticated requests and stores client data without adequate resource controls. A remote attacker can exhaust server memory resources by sending large registration payloads, leading to a denial of service that renders the instance unavailable. The endpoint remains reachable even if the MCP enable/disable toggle is used to gate access.

Recommendations Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-06924

CVE-2026-42236

GHSA-49M9-PGWW-9VQ6

Affected Products

N8N

References · 12

• https://github.com/n8n-io/n8n/security/advisories/GHSA-49m9-pgww-9vq6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-49m9-pgww-9vq6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42236 · Security Note
• https://bdu.fstec.ru/vul/2026-06924 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/2051383966343532656 · Twitter Post
• https://twitter.com/cybrsecpath/status/2052076705947455701 · Twitter Post
• https://twitter.com/VigneshVic23698/status/2052309236399620370 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051518847790809389 · Twitter Post
• https://t.me/true_secator/8200 · Telegram Post
• https://twitter.com/SelvaKtm2/status/2052078361242218753 · Twitter Post
• https://t.me/CVEtracker/52663 · Telegram Post