How severe is CVE-2026-42230?

CVE-2026-42230 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-42230 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-42230?

CVE-2026-42230 primarily affects N8n. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-42230?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-42230 have an EU (EUVD) identifier?

Yes. CVE-2026-42230 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-27100.

When was CVE-2026-42230 published?

CVE-2026-42230 was published on 2026-05-04 and last updated on 2026-06-17.

CVE-2026-42230

CVE-2026-42230 is a medium-severity vulnerability in N8n with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-601.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
CVSS v4: 5.1
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-27100
Weakness: CWE-601
Affected product: N8n
Published: 2026-05-04
Last modified: 2026-06-17

Description

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /mcp-oauth/register endpoint accepted OAuth client registrations without authentication, allowing arbitrary redirect_uri values to be registered. When a user denies the MCP OAuth consent dialog, the handleDeny handler redirects the user to the registered redirect_uri without validation, enabling an open redirect to an attacker-controlled URL. An attacker can craft a phishing link and send it to a victim; if the victim clicks "Deny" on the consent page, they are silently redirected to an external site. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

Frequently asked questions

What is CVE-2026-42230?: n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /mcp-oauth/register endpoint accepted OAuth client registrations without authentication, allowing arbitrary redirect_uri values to be registered. When a user denies the MCP OAuth consent dialog, the handleDeny handler redirects the user to the registered redirect_uri without validation, enabling an open redirect to an attacker-controlled URL. An attacker can craft a phishing link and send it to a victim; if the victim clicks "Deny" on the consent page, they are silently redirected to an external site. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
How severe is CVE-2026-42230?: CVE-2026-42230 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-42230 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-42230?: CVE-2026-42230 primarily affects N8n. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-42230?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-42230 have an EU (EUVD) identifier?: Yes. CVE-2026-42230 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-27100.
When was CVE-2026-42230 published?: CVE-2026-42230 was published on 2026-05-04 and last updated on 2026-06-17.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-f6x8-65q6-j9m9

Affected products (2)

cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*
cpe:2.3:a:n8n:n8n:2.18.0:*:*:*:enterprise:node.js:*:*

More vulnerabilities in N8n

CVE-2026-54309 — Critical (CVSS 10.0): n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP…
CVE-2026-21858 — Critical (CVSS 10.0): n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker…
CVE-2026-54305 — Critical (CVSS 9.9): n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by…
CVE-2026-44791 — Critical (CVSS 9.9): n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with…
CVE-2026-44789 — Critical (CVSS 9.9): n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with…
CVE-2026-54310 — Critical (CVSS 9.9): n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission…

All CVEs affecting N8n →

Other CWE-601 (Open Redirect) vulnerabilities

CVE-2018-3774 — Critical (CVSS 10.0): Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open…
CVE-2019-25282 — Critical (CVSS 9.8): V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to…
CVE-2020-36912 — Critical (CVSS 9.8): Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script…
CVE-2025-43526 — Critical (CVSS 9.8): This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac…
CVE-2025-55031 — Critical (CVSS 9.8): Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An…
CVE-2024-22891 — Critical (CVSS 9.8): Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.

Browse all CWE-601 (Open Redirect) vulnerabilities →