Executive brief
n8n is a workflow automation platform that allows organizations to build and execute automated processes. An unauthenticated attacker can send large registration requests to the MCP OAuth endpoint, exhausting server memory and rendering the n8n instance unavailable. This affects any n8n deployment regardless of whether the MCP feature is enabled, potentially disrupting critical business workflows and operations.
Technical details
The vulnerability exists in n8n's MCP (Model Context Protocol) OAuth client registration endpoint, which accepts unauthenticated requests without adequate resource controls. An attacker can exploit this by sending large payloads to the registration endpoint, causing the server to accumulate unbounded client registrations in memory (CWE-770: Allocation of Resources Without Limits or Throttling). The endpoint is reachable regardless of whether MCP is enabled on the instance due to insufficient input validation and authentication checks. An unauthenticated remote attacker with network access can exhaust server memory, causing denial of service. Patches are available in n8n versions 1.123.32, 2.17.4, and 2.18.1, which implement an upper bound on registered clients and disable creation when MCP is disabled. Temporary mitigations include network access restriction and reducing the N8N_PAYLOAD_SIZE_MAX environment variable.
Affected products
- n8n n8n < 1.123.32, >= 2.0.0 and < 2.17.4, >= 2.18.0 and < 2.18.1
Timeline
- 2026-04-22: disclosed
- 2026-04-29: patched: Patches released in versions 1.123.32, 2.17.4, and 2.18.1
- 2026-04-29: advisory