AI Threat Alert
n8n's MCP OAuth registration endpoint (/mcp-oauth/register) accepts arbitrary redirect URIs without any authentication, allowing an attacker to pre-register a malicious destination before any user interaction occurs. The attack exploits user intuition: a victim who clicks a crafted link and then chooses 'Deny' on the consent dialog — the expected safe action — is silently forwarded to an attacker-controlled phishing site. With 75 prior CVEs in this package, an EPSS score placing this in the top 86th percentile for exploitation likelihood, and n8n's broad deployment as an AI agent orchestration platform handling sensitive LLM API credentials, the blast radius extends well beyond a simple redirect. Organizations running n8n should patch to 1.123.32 (v1) or 2.17.4/2.18.1 (v2) immediately and audit existing OAuth registrations for unexpected external redirect URIs.
What is the risk?
Medium risk. The vulnerability is trivially exploitable — no authentication or technical skill required to register a malicious OAuth client via the open endpoint. While the direct impact is limited to an open redirect with no code execution or direct data exfiltration, the operational context is high-value: n8n workflows commonly orchestrate AI agent pipelines with embedded credentials for LLM APIs, vector databases, and cloud services. The attack is particularly dangerous against technical users managing AI infrastructure, since denying a suspicious consent dialog is the intuitive secure response yet still triggers the redirect. EPSS 86th percentile and 75 historical CVEs in the same package signal a persistently vulnerable codebase requiring active monitoring.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | < 1.123.32 | 1.123.32 |
Do you use n8n? You're affected.
How severe is it?
What should I do?
5 steps-
Patch immediately: upgrade to n8n 1.123.32 (v1 branch) or 2.17.4/2.18.1 (v2 branch).
-
If patching is delayed, block unauthenticated external access to /mcp-oauth/register at the WAF or network perimeter.
-
Audit all registered OAuth clients in your n8n instance for unexpected external redirect_uri values and purge any not explicitly authorized.
-
Review server logs for unauthenticated POST requests to /mcp-oauth/register, especially from external IPs.
-
Alert users not to enter credentials on any page reached following an n8n consent interaction until the patch is confirmed deployed.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-42230?
n8n's MCP OAuth registration endpoint (/mcp-oauth/register) accepts arbitrary redirect URIs without any authentication, allowing an attacker to pre-register a malicious destination before any user interaction occurs. The attack exploits user intuition: a victim who clicks a crafted link and then chooses 'Deny' on the consent dialog — the expected safe action — is silently forwarded to an attacker-controlled phishing site. With 75 prior CVEs in this package, an EPSS score placing this in the top 86th percentile for exploitation likelihood, and n8n's broad deployment as an AI agent orchestration platform handling sensitive LLM API credentials, the blast radius extends well beyond a simple redirect. Organizations running n8n should patch to 1.123.32 (v1) or 2.17.4/2.18.1 (v2) immediately and audit existing OAuth registrations for unexpected external redirect URIs.
Is CVE-2026-42230 actively exploited?
No confirmed active exploitation of CVE-2026-42230 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-42230?
1. Patch immediately: upgrade to n8n 1.123.32 (v1 branch) or 2.17.4/2.18.1 (v2 branch). 2. If patching is delayed, block unauthenticated external access to /mcp-oauth/register at the WAF or network perimeter. 3. Audit all registered OAuth clients in your n8n instance for unexpected external redirect_uri values and purge any not explicitly authorized. 4. Review server logs for unauthenticated POST requests to /mcp-oauth/register, especially from external IPs. 5. Alert users not to enter credentials on any page reached following an n8n consent interaction until the patch is confirmed deployed.
What systems are affected by CVE-2026-42230?
This vulnerability affects the following AI/ML architecture patterns: AI agent orchestration platforms, Workflow automation with LLM integrations, MCP (Model Context Protocol) deployments, Multi-tool AI agent pipelines.
What is the CVSS score for CVE-2026-42230?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011.003 Malicious Link AML.T0048.003 User Harm AML.T0049 Exploit Public-Facing Application AML.T0052 Phishing Compliance Controls Affected
What are the technical details?
Original Advisory
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /mcp-oauth/register endpoint accepted OAuth client registrations without authentication, allowing arbitrary redirect_uri values to be registered. When a user denies the MCP OAuth consent dialog, the handleDeny handler redirects the user to the registered redirect_uri without validation, enabling an open redirect to an attacker-controlled URL. An attacker can craft a phishing link and send it to a victim; if the victim clicks "Deny" on the consent page, they are silently redirected to an external site. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
Exploitation Scenario
An attacker identifies an internet-exposed n8n instance and sends an unauthenticated POST to /mcp-oauth/register with redirect_uri pointing to a phishing site mimicking an AI service login page (e.g., a fake OpenAI API key portal). The attacker then crafts an OAuth initiation URL and delivers it to a DevOps engineer or data scientist via a phishing email framed as a legitimate n8n integration request. The victim opens the link, sees a familiar n8n consent dialog, and clicks 'Deny' — the expected safe action. The handleDeny handler silently redirects the victim to the attacker's phishing site. The victim, having just rejected an authorization, is psychologically off-guard and far more likely to enter their AI service credentials on what appears to be a routine login page, giving the attacker direct access to LLM APIs and connected AI infrastructure.
Weaknesses (CWE)
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Primary
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Primary
CWE-601 — URL Redirection to Untrusted Site ('Open Redirect'): The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-33663 10.0 n8n: member role steals plaintext HTTP credentials
Same package: n8n CVE-2026-33660 10.0 TensorFlow: type confusion NPD in tensor conversion
Same package: n8n CVE-2026-21858 10.0 n8n: Input Validation flaw enables exploitation
Same package: n8n CVE-2026-27577 9.9 n8n: Code Injection enables RCE
Same package: n8n CVE-2026-27495 9.9 n8n: Code Injection enables RCE
Same package: n8n