CVE-2026-42236: n8n unauthenticated MCP endpoint

Q: Is CVE-2026-42236 actively exploited?

No confirmed active exploitation of CVE-2026-42236 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-42236?

1. Patch: Upgrade n8n to 1.123.32 (v1 branch), 2.17.4, or 2.18.1 immediately. 2. Network controls: If patching is not immediately possible, restrict access to the MCP OAuth client registration endpoint via WAF rules, reverse proxy ACLs, or network segmentation—block unauthenticated POST requests to that route. 3. Detection: Monitor for abnormal memory consumption on n8n hosts, unexpected spikes in POST requests to MCP-related endpoints, and OOM (out-of-memory) events in n8n process logs. 4. Verification: Do not rely on the MCP toggle for protection—confirm patched version is running. 5. Inventory: Identify all n8n deployments including self-hosted instances in CI/CD pipelines or agent stacks and prioritize internet-facing ones for immediate patching.

Q: What systems are affected by CVE-2026-42236?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation, LLM orchestration pipelines, MCP-enabled AI deployments.

Q: What is the CVSS score for CVE-2026-42236?

No CVSS score has been assigned yet.

CISO Take

n8n's MCP OAuth client registration endpoint accepted unauthenticated POST requests with no rate limiting or payload size constraints, allowing any remote attacker to exhaust server memory by flooding it with large registration payloads. Critically, the MCP enable/disable toggle—the expected access control—did not protect this endpoint, meaning all n8n deployments were exposed regardless of their MCP configuration. With 75 prior CVEs in this package, an OpenSSF score of 6/10, and a risk score of 69/100, n8n carries elevated supply chain risk in AI agent pipelines where it commonly orchestrates LLM calls and external tool integrations. Patch immediately to versions 1.123.32, 2.17.4, or 2.18.1; if patching is not immediately feasible, block access to the MCP OAuth registration endpoint at the network perimeter via WAF or reverse proxy ACL.

Sources: NVD GitHub Advisory EPSS ATLAS OpenSSF

What is the risk?

MEDIUM. The vulnerability is trivially exploitable—no authentication, no specialized knowledge, just HTTP requests—and can render n8n instances completely unavailable. Exploitation likelihood remains modest (EPSS 0.00082, top 76th percentile, not in CISA KEV, no public exploit or scanner template), but risk is elevated for organizations using n8n as a central AI agent orchestration layer where service disruption cascades into downstream LLM workflows and automated pipelines.

How does the attack unfold?

Reconnaissance

Adversary discovers internet-facing n8n instance via public scanning tools such as Shodan, Censys, or subdomain enumeration.

AML.T0006

Initial Access

Adversary directly accesses the unauthenticated MCP OAuth client registration endpoint without credentials—no bypass required, the endpoint is openly accessible by design flaw.

AML.T0049

Resource Exhaustion

Adversary floods the registration endpoint with oversized JSON payloads in a loop; n8n stores each in memory without limits or throttling until server RAM is exhausted.

AML.T0034.002

Impact

n8n instance crashes or becomes unresponsive, disrupting all AI agent workflows, LLM integrations, automated pipelines, and MCP-connected tools.

AML.T0029

Reconnaissance

Adversary discovers internet-facing n8n instance via public scanning tools such as Shodan, Censys, or subdomain enumeration.

AML.T0006

Initial Access

Adversary directly accesses the unauthenticated MCP OAuth client registration endpoint without credentials—no bypass required, the endpoint is openly accessible by design flaw.

AML.T0049

Resource Exhaustion

Adversary floods the registration endpoint with oversized JSON payloads in a loop; n8n stores each in memory without limits or throttling until server RAM is exhausted.

AML.T0034.002

Impact

n8n instance crashes or becomes unresponsive, disrupting all AI agent workflows, LLM integrations, automated pipelines, and MCP-connected tools.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.32	`1.123.32`
193.4K OpenSSF 6.6 Pushed 4d ago 54% patched ~7d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

5 steps

Patch: Upgrade n8n to 1.123.32 (v1 branch), 2.17.4, or 2.18.1 immediately.
Network controls: If patching is not immediately possible, restrict access to the MCP OAuth client registration endpoint via WAF rules, reverse proxy ACLs, or network segmentation—block unauthenticated POST requests to that route.
Detection: Monitor for abnormal memory consumption on n8n hosts, unexpected spikes in POST requests to MCP-related endpoints, and OOM (out-of-memory) events in n8n process logs.
Verification: Do not rely on the MCP toggle for protection—confirm patched version is running.
Inventory: Identify all n8n deployments including self-hosted instances in CI/CD pipelines or agent stacks and prioritize internet-facing ones for immediate patching.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent Framework AML.T0029 - Denial of AI Service AML.T0034.002 - Agentic Resource Consumption AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.1 - AI system availability and resilience

NIST AI RMF

MANAGE 2.2 - AI risk controls are monitored and documented

OWASP LLM Top 10

LLM10 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-42236?

n8n's MCP OAuth client registration endpoint accepted unauthenticated POST requests with no rate limiting or payload size constraints, allowing any remote attacker to exhaust server memory by flooding it with large registration payloads. Critically, the MCP enable/disable toggle—the expected access control—did not protect this endpoint, meaning all n8n deployments were exposed regardless of their MCP configuration. With 75 prior CVEs in this package, an OpenSSF score of 6/10, and a risk score of 69/100, n8n carries elevated supply chain risk in AI agent pipelines where it commonly orchestrates LLM calls and external tool integrations. Patch immediately to versions 1.123.32, 2.17.4, or 2.18.1; if patching is not immediately feasible, block access to the MCP OAuth registration endpoint at the network perimeter via WAF or reverse proxy ACL.

Is CVE-2026-42236 actively exploited?

No confirmed active exploitation of CVE-2026-42236 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-42236?

1. Patch: Upgrade n8n to 1.123.32 (v1 branch), 2.17.4, or 2.18.1 immediately. 2. Network controls: If patching is not immediately possible, restrict access to the MCP OAuth client registration endpoint via WAF rules, reverse proxy ACLs, or network segmentation—block unauthenticated POST requests to that route. 3. Detection: Monitor for abnormal memory consumption on n8n hosts, unexpected spikes in POST requests to MCP-related endpoints, and OOM (out-of-memory) events in n8n process logs. 4. Verification: Do not rely on the MCP toggle for protection—confirm patched version is running. 5. Inventory: Identify all n8n deployments including self-hosted instances in CI/CD pipelines or agent stacks and prioritize internet-facing ones for immediate patching.

What systems are affected by CVE-2026-42236?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation, LLM orchestration pipelines, MCP-enabled AI deployments.

What is the CVSS score for CVE-2026-42236?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automationLLM orchestration pipelinesMCP-enabled AI deployments

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.002 Agentic Resource Consumption

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.1

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint accepted unauthenticated requests and stored client data without adequate resource controls. An unauthenticated remote attacker could exhaust server memory resources by sending large registration payloads, rendering the n8n instance unavailable. The MCP enable/disable toggle gates MCP access but did not restrict client registrations, meaning the endpoint is reachable regardless of whether MCP access is enabled on the instance. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

Exploitation Scenario

An adversary identifies an internet-facing n8n instance via Shodan, Censys, or subdomain enumeration. Without any credentials or prior access, they script a loop that repeatedly POSTs oversized JSON payloads to the MCP OAuth client registration endpoint. Since n8n stores each registration payload in server memory without limits or throttling, and the endpoint remains reachable even with MCP disabled, the server's available RAM is progressively exhausted. After a sustained flood—achievable in minutes with a basic HTTP client—the n8n process crashes or becomes unresponsive, taking all orchestrated AI workflows and LLM integrations offline. No AI or ML knowledge is required; the attack is within reach of any script-kiddie with a target IP and a curl command.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling Primary

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.