{"id":"CVE-2026-126386","kind":"vulnerability","aliases":["CVE-2026-126386"],"related":[],"title":"n8n: open redirect in MCP OAuth registration enables phishing","description":"n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect vulnerability in the unauthenticated MCP OAuth dynamic client registration flow, which accepts arbitrary redirect_uri values via the /mcp-oauth/register endpoint. Attackers can send victims crafted /mcp-oauth/authorize URLs that redirect them to attacker-controlled sites before instance checks run, enabling phishing.","summary":"n8n's MCP OAuth dynamic client registration accepts any redirect_uri without checks, so an unauthenticated attacker can build /mcp-oauth/authorize links that send victims to attacker-controlled sites. The result is phishing that starts from a trusted n8n URL.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","n8n","self-hosted"],"not_affected_if":["fixed-version","managed-hosting"],"how_to_check":"- Check the n8n version with `n8n --version` or the instance's About page; versions below `1.123.89`, `2.45.5` (2.x line), `2.46.1` (2.46.x line) or `3.0.1` are affected.\n- Check whether MCP OAuth endpoints such as `/mcp-oauth/register` are reachable on the instance.","fix":"- n8n 1.x: `1.123.89`\n- n8n 2.x: `2.45.5`\n- n8n 2.46.x: `2.46.1`\n- n8n 3.x: `3.0.1`","status":"open","published_at":"2026-11-13T10:17:41+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","triaged_at":"2026-11-13T10:58:39+00:00","updated_at":"2026-11-13T10:58:39+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:58:39Z","model":"claude-haiku-5-5","output":{"fix":"- n8n 1.x: `1.123.89`\n- n8n 2.x: `2.45.5`\n- n8n 2.46.x: `2.46.1`\n- n8n 3.x: `3.0.1`","reach":"internet","title":"n8n: open redirect in MCP OAuth registration enables phishing","impact":"low","summary":"n8n's MCP OAuth dynamic client registration accepts any redirect_uri without checks, so an unauthenticated attacker can build /mcp-oauth/authorize links that send victims to attacker-controlled sites. The result is phishing that starts from a trusted n8n URL.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","mcp"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"victims are redirected to attacker sites for phishing","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the instance's About page; versions below `1.123.89`, `2.45.5` (2.x line), `2.46.1` (2.46.x line) or `3.0.1` are affected.\n- Check whether MCP OAuth endpoints such as `/mcp-oauth/register` are reachable on the instance.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","fixed-version"],"who_is_affected":"Teams that run a self-hosted n8n instance with the MCP OAuth flow reachable from the internet are exposed, because the registration endpoint accepts unauthenticated requests. Instances on the affected version ranges that do not expose MCP OAuth endpoints are less exposed, and managed or fixed-version instances are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000798,"input_tokens":4690,"output_tokens":657,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126386':12A,15A '-2026':11A,14A '/mcp-oauth/authorize':43B,109C '/mcp-oauth/register':102C '1.123.89':66C '2':67C '2.45.5':70C '2.46':71C '2.46.1':74C '3':76C '3.0.1':79C 'accept':31B,95C 'ai':17B 'ai-tool':16B 'arbitrari':96C 'attack':40B,50B,104C,116C 'attacker-control':49B,115C 'build':42B 'check':36B,121C 'client':29B,91C 'contain':80C 'control':51B,117C 'craft':108C 'cve':10A,13A 'dynam':28B,90C 'enabl':8A,123C 'endpoint':103C 'flow':93C 'host':23B 'instanc':120C 'link':44B 'mcp':5A,19B,26B,88C 'n8n':1A,20B,24B,62B,64C 'oauth':6A,27B,89C 'open':2A,82C 'phish':9A,56B,124C 'redirect':3A,33B,83C,97C,112C 'registr':7A,30B,92C 'result':54B 'run':122C 'self':22B 'self-host':21B 'send':46B,106C 'site':52B,118C 'start':58B 'tool':18B 'trust':61B 'unauthent':39B,87C 'uri':34B,98C 'url':63B,110C 'valu':99C 'via':100C 'victim':47B,107C 'vulner':84C 'without':35B 'x':68C,72C,77C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted n8n instance with the MCP OAuth flow reachable from the internet are exposed, because the registration endpoint accepts unauthenticated requests. Instances on the affected version ranges that do not expose MCP OAuth endpoints are less exposed, and managed or fixed-version instances are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","mcp","medium","n8n","selfhosted"],"campaign_type":null,"search_a":"'-126386':12A,15A '-2026':11A,14A 'cve':10A,13A 'enabl':8A 'mcp':5A 'n8n':1A 'oauth':6A 'open':2A 'phish':9A 'redirect':3A 'registr':7A","search_b":"'/mcp-oauth/authorize':43B 'accept':31B 'ai':17B 'ai-tool':16B 'attack':40B,50B 'attacker-control':49B 'build':42B 'check':36B 'client':29B 'control':51B 'dynam':28B 'host':23B 'link':44B 'mcp':19B,26B 'n8n':20B,24B,62B 'oauth':27B 'phish':56B 'redirect':33B 'registr':30B 'result':54B 'self':22B 'self-host':21B 'send':46B 'site':52B 'start':58B 'tool':18B 'trust':61B 'unauthent':39B 'uri':34B 'url':63B 'victim':47B 'without':35B","search_c":"'/mcp-oauth/authorize':109C '/mcp-oauth/register':102C '1.123.89':66C '2':67C '2.45.5':70C '2.46':71C '2.46.1':74C '3':76C '3.0.1':79C 'accept':95C 'arbitrari':96C 'attack':104C,116C 'attacker-control':115C 'check':121C 'client':91C 'contain':80C 'control':117C 'craft':108C 'dynam':90C 'enabl':123C 'endpoint':103C 'flow':93C 'instanc':120C 'mcp':88C 'n8n':64C 'oauth':89C 'open':82C 'phish':124C 'redirect':83C,97C,112C 'registr':92C 'run':122C 'send':106C 'site':118C 'unauthent':87C 'uri':98C 'url':110C 'valu':99C 'via':100C 'victim':107C 'vulner':84C 'x':68C,72C,77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126386","severity":null,"published_at":"2026-11-13T10:17:41+00:00","modified_at":"2026-11-13T10:17:41+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","fetched_at":"2026-11-13T10:47:18+00:00","note":null}],"documents":[{"id":110630,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-rc3w-8jc8-7x3w","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-28T08:48:38+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145015,"url":"https://www.vulncheck.com/advisories/n8n-before-1.123.89-open-redirect-via-mcp-oauth-dynamic-client-registration","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}