CVE-2026-126386: n8n: open redirect in MCP OAuth enables phishing

MEDIUM

Published November 13, 2026

CISO Take

n8n has an open redirect flaw in its unauthenticated MCP OAuth dynamic client registration flow: the /mcp-oauth/register endpoint accepts arbitrary redirect_uri values, so a crafted /mcp-oauth/authorize link can send a victim to an attacker-controlled site before any instance checks run. The CVSS score is a moderate 4.7, and there is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so mass exploitation is not indicated today. The risk is still real for organizations that expose n8n to the internet. A link on your own trusted n8n domain makes phishing credible, and n8n often holds credentials for the AI agents and SaaS systems it orchestrates. Patch to 1.123.89, 2.45.5, 2.46.1 or 3.0.1 (or later), and if you cannot patch promptly, restrict access to the /mcp-oauth/* endpoints.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Medium. The endpoint is reachable over the network without authentication, and the attack is low complexity, but the victim has to click a crafted link (UI:R). The scope is changed (S:C) and only integrity is affected, at a low level. There are no signs of active exploitation: no KEV entry, no public exploit, no scanner template and no EPSS data. The main exposure is internet-facing n8n instances with MCP OAuth enabled, where the legitimate domain lends the phishing link credibility.

How does the attack unfold?

Initial Access

Attacker registers an OAuth client at /mcp-oauth/register with an attacker-controlled redirect_uri, without authentication.

AML.T0049

Delivery

Attacker sends the victim a crafted /mcp-oauth/authorize link on the legitimate n8n domain.

AML.T0052

Exploitation

The victim clicks the link and is redirected to the attacker's site before instance checks run.

AML.T0011.003

Impact

The victim submits credentials or approves OAuth access on the phishing page, which exposes accounts connected to AI agent workflows.

Initial Access

Attacker registers an OAuth client at /mcp-oauth/register with an attacker-controlled redirect_uri, without authentication.

AML.T0049

Delivery

Attacker sends the victim a crafted /mcp-oauth/authorize link on the legitimate n8n domain.

AML.T0052

Exploitation

The victim clicks the link and is redirected to the attacker's site before instance checks run.

AML.T0011.003

Impact

The victim submits credentials or approves OAuth access on the phishing page, which exposes accounts connected to AI agent workflows.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.8KOpenSSF 7.016 dependentsPushed 6d ago42% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

4.7 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SChanged

CNone

ILow

ANone

What should I do?

1 step

1) Upgrade n8n to 1.123.89, 2.45.5, 2.46.1, 3.0.1 or later. 2) If you cannot patch immediately, block or restrict /mcp-oauth/register and /mcp-oauth/authorize at the reverse proxy or WAF, or limit access to trusted networks or a VPN. 3) Detect abuse by reviewing proxy and access logs for /mcp-oauth/register calls with unexpected redirect_uri hosts and for /mcp-oauth/authorize requests that carry external redirect targets. 4) Tell users to treat unsolicited n8n links with caution, and review OAuth clients that were registered dynamically.

How is it classified?

Social EngineeringAuth BypassAgentFrameworkPluginAML.T0011.003- Malicious Link AML.T0049- Exploit Public-Facing Application AML.T0052- Phishing

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to identified AI risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-126386?

Is CVE-2026-126386 actively exploited?

No confirmed active exploitation of CVE-2026-126386 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126386?

1) Upgrade n8n to 1.123.89, 2.45.5, 2.46.1, 3.0.1 or later. 2) If you cannot patch immediately, block or restrict /mcp-oauth/register and /mcp-oauth/authorize at the reverse proxy or WAF, or limit access to trusted networks or a VPN. 3) Detect abuse by reviewing proxy and access logs for /mcp-oauth/register calls with unexpected redirect_uri hosts and for /mcp-oauth/authorize requests that carry external redirect targets. 4) Tell users to treat unsolicited n8n links with caution, and review OAuth clients that were registered dynamically.

What systems are affected by CVE-2026-126386?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, MCP server integrations, OAuth-integrated AI agent tooling.

What is the CVSS score for CVE-2026-126386?

CVE-2026-126386 has a CVSS v3.1 base score of 4.7 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsMCP server integrationsOAuth-integrated AI agent tooling

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0049Exploit Public-Facing Application

AML.T0052Phishing

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect vulnerability in the unauthenticated MCP OAuth dynamic client registration flow, which accepts arbitrary redirect_uri values via the /mcp-oauth/register endpoint. Attackers can send victims crafted /mcp-oauth/authorize URLs that redirect them to attacker-controlled sites before instance checks run, enabling phishing.

Exploitation Scenario

An attacker registers an OAuth client through the unauthenticated /mcp-oauth/register endpoint with a redirect_uri pointing to a domain they control. They then send employees who use the company n8n instance a crafted /mcp-oauth/authorize link, for example in a message about an agent workflow or MCP integration. The link starts on the legitimate n8n domain, so it looks trustworthy. Before the instance checks run, the victim is redirected to a lookalike login or consent page, where the attacker harvests credentials, MFA codes or OAuth approvals tied to AI agent and automation services.

Weaknesses (CWE)

CWE-601URL Redirection to Untrusted SitePrimary CWE-601URL Redirection to Untrusted Site

CWE-601 — URL Redirection to Untrusted Site: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.

Source: MITRE CWE corpus.