AI Threat AlertCVE-2026-126385: n8n: OAuth2 callback flaw hijacks victim tokens
HIGHn8n's dynamic-credential OAuth2 callback never checks that the browser completing the flow belongs to the user who started it. A low-privileged member can therefore send a provider authorization URL to a victim, and if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, so the member's workflows can act as the victim. This is rated high (CVSS 7.7, scope changed, high confidentiality and integrity impact) and needs user interaction plus a member account. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so exploitation is not currently observed. n8n often holds OAuth tokens for email, CRM, cloud and AI services, which makes the downstream blast radius large in multi-user instances. Upgrade to n8n 2.45.5, 2.46.1 or 3.0.1 or later, and audit OAuth2 credentials created through the dynamic-credential flow for unexpected account bindings.
What is the risk?
Medium-high. Exploitation needs a valid member account (PR:L), high attack complexity and victim interaction, which limits mass exploitation. The scope change and high confidentiality and integrity impact mean a successful attack grants lasting delegated access to the victim's third-party accounts. Insider and shared-tenant n8n deployments carry the highest exposure. No public exploit, KEV listing or EPSS data is available, so likelihood is moderate.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade to n8n 2.45.5, 2.46.1 or 3.0.1 or later. 2) Until patched, restrict member access to resolvable OAuth2 credentials and disable or limit the dynamic-credential connect flow. 3) Train users not to approve OAuth consent links received from others, and to sign in to n8n before consenting. 4) Audit OAuth2 credentials and the workflows that use them for tokens bound to the wrong identity, and revoke and re-issue suspicious tokens at the provider. 5) Review provider-side OAuth grant logs for consent events that have no matching n8n session activity. 6) Apply least privilege to scopes requested by n8n credentials.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-126385?
n8n's dynamic-credential OAuth2 callback never checks that the browser completing the flow belongs to the user who started it. A low-privileged member can therefore send a provider authorization URL to a victim, and if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, so the member's workflows can act as the victim. This is rated high (CVSS 7.7, scope changed, high confidentiality and integrity impact) and needs user interaction plus a member account. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so exploitation is not currently observed. n8n often holds OAuth tokens for email, CRM, cloud and AI services, which makes the downstream blast radius large in multi-user instances. Upgrade to n8n 2.45.5, 2.46.1 or 3.0.1 or later, and audit OAuth2 credentials created through the dynamic-credential flow for unexpected account bindings.
Is CVE-2026-126385 actively exploited?
No confirmed active exploitation of CVE-2026-126385 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-126385?
1) Upgrade to n8n 2.45.5, 2.46.1 or 3.0.1 or later. 2) Until patched, restrict member access to resolvable OAuth2 credentials and disable or limit the dynamic-credential connect flow. 3) Train users not to approve OAuth consent links received from others, and to sign in to n8n before consenting. 4) Audit OAuth2 credentials and the workflows that use them for tokens bound to the wrong identity, and revoke and re-issue suspicious tokens at the provider. 5) Review provider-side OAuth grant logs for consent events that have no matching n8n session activity. 6) Apply least privilege to scopes requested by n8n credentials.
What systems are affected by CVE-2026-126385?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, multi-user AI orchestration, OAuth-integrated tool connectors.
What is the CVSS score for CVE-2026-126385?
CVE-2026-126385 has a CVSS v3.1 base score of 7.7 (HIGH).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0052PhishingAML.T0053AI Agent Tool InvocationAML.T0091.000Application Access TokenAML.T0106Exploitation for Credential AccessCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.
Exploitation Scenario
A malicious or compromised member of a shared n8n instance finds an OAuth2 credential they can resolve, such as one for Google Workspace or Microsoft 365. They start the dynamic-credential connect flow and send the provider authorization URL to a colleague in a plausible message. The colleague, with no active n8n session, consents. The n8n callback stores the colleague's tokens under the attacker's identity without checking who completed the flow. The attacker then builds workflows or AI agents that read the colleague's mail and files or send messages as them, and exfiltrate the data.
Weaknesses (CWE)
CWE-306Missing Authentication for Critical FunctionalityPrimaryCWE-306Missing Authentication for Critical FunctionalityCWE-306 — Missing Authentication for Critical Functionality: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- [Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n