Is CVE-2026-110843 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110843 being exploited in the wild.

How severe is CVE-2026-110843?

Informational severity, published 14 October 2026.

Which products and versions are affected?

N8n before 2.41.4; 2.42.0 before 2.42.1.

How is CVE-2026-110843 attacked?

It is attacked over the network.

Am I affected by CVE-2026-110843?

Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110843: n8n uncontrolled resource consumption in OAuth authorize endpoint

CVE-2026-110843 · Severity: info · Published 2026-10-14

n8n is a low-code automation platform that uses OAuth for third-party integrations. An unauthenticated attacker can exploit a flaw in the OAuth authorize endpoint to create unlimited client records by varying query strings in requests, bypassing the registration cap and causing the database to grow until the disk fills, resulting in service unavailability.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-110843 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110843 being exploited in the wild.
How severe is CVE-2026-110843?: Informational severity, published 14 October 2026.
Which products and versions are affected?: N8n before 2.41.4; 2.42.0 before 2.42.1.
Is there a fix for CVE-2026-110843?: Yes: fixed in n8n 2.41.4, 2.42.1. Until then: Restrict network access to the n8n instance to trusted users and systems only. Deactivate or reconfigure any workflows using Form Trigger or Chat Trigger nodes with n8nUserAuth authentication until the instance is patched. Monitor database size for unexpected growth and set filesystem-level disk usage alerts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110843 attacked?: It is attacked over the network.
Am I affected by CVE-2026-110843?: Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: n8n 2.41.4, 2.42.1

Restrict network access to the n8n instance to trusted users and systems only. Deactivate or reconfigure any workflows using Form Trigger or Chat Trigger nodes with n8nUserAuth authentication until the instance is patched. Monitor database size for unexpected growth and set filesystem-level disk usage alerts.

Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-770) in the OAuth authorize endpoint. The endpoint resolves clients by URL path but stores the raw caller identifier as the database key, allowing attackers to create unbounded first-party client records by using identifiers differing only in query strings. These records bypass the registration cap, have no expiry or deletion mechanism, and persist in the database until manual remediation or disk exhaustion occurs.

Affected products

n8n n8n before 2.41.4; 2.42.0 before 2.42.1

Timeline

2026-09-30: disclosed
2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.