CVE-2026-42235 - Vulnerability Analysis

Overview

n8n < 1.123.32, 2.17.4, 2.18.1 contains a stored XSS caused by improper sanitization of client_name in MCP OAuth client registration, letting unauthenticated attackers execute arbitrary JavaScript in victim's session, exploit requires victim user interaction.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in authenticated sessions, leading to credential theft, session hijacking, and privilege escalation.

Mitigation

Update to versions 1.123.32, 2.17.4, or 2.18.1 or later.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-537j-gqpc-p7fq

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner