CVE-2026-126385 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
n8n's OAuth2 credential callback in the dynamic-credential connect flow does not check that the browser completing the flow belongs to the user who started it. A member with access to an OAuth2 credential can send the provider's authorization link to a victim, and if the victim consents without an active n8n session, the victim's tokens are stored under the member's account so the member's workflows act as the victim.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host n8n or run it on a managed plan, specifically instances that use OAuth2 credentials created through the dynamic-credential connect flow and that let more than one member create or connect credentials. A member needs access to a resolvable OAuth2 credential, and the victim must consent in a browser, so single-user instances without shared OAuth2 credentials face much less risk.
Not affected if managed-hosting-patched, no-oauth2-credentials, single-user-instance
Who cares n8n, oauth2, self-hosted, workflow-automation
Unknown from the sources.
2.45.5 or later on the 2.45 line2.46.1 or later on the 2.46 line3.0.1 or later on the 3.x linen8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.