Signal is active with 5 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted client_name. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that access, a toast notification would render the injected script. Clicking the link would execute arbitrary JavaScript in the victim's authenticated n8n browser session, enabling credential and session token theft, workflow manipulation, or privilege escalation. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-05-04 | 1 | Disclosure1 |
| 2026-05-05 | 1 | Disclosure1 |
| 2026-05-13 | 5 | Disclosure2General3 |
CVE: CVE-2026-42235 CVSS: 9.6 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory n8n is an open source workflow automation platform.
Post summary
A critical CVE (CVE‑2026‑42235) affecting n8n has been identified with a high CVSS score, but no exploitation or mitigation details are provided.
--- Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation. CVE: CVE-2026-42235 CVSS: 9.6 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
Stakeholders are informed of a newly identified critical vulnerability, CVE-2026-42235, with a CVSS score of 9.6 and severity label CRITICAL.
CRITICAL: CVE-2026-42235 (CVSS 9.6) — n8n n8n. CVE: CVE-2026-42235 CVSS: 9.6 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The post announces a critical vulnerability (CVE‑2026‑42235) with CVSS 9.6 for n8n, but provides no PoC, exploit, or patch details.
References CVE: CVE-2026-42235 CVSS: 9.6 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text reports a critical severity advisory for CVE-2026-42235, including its CVSS score and vector, but provides no PoC, exploit, active usage, or mitigation information.
https://lyrie.ai/research/research/cve-2026-42235-n8n-n8n #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The post references a link to research on CVE‑2026‑42235 in n8n, but it contains no explicit technical details, PoC, patch information, or evidence of active exploitation.
CVE-2026-42235 Unauthenticated Cross-Site Scripting via MCP OAuth Client Registration i... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42235 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The tweet announces CVE‑2026‑42235, describing it as an unauthenticated XSS flaw in MCP OAuth client registration, but provides no PoC, exploit code, patch, or evidence of active exploitation.
CVE-2026-42235 n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth c… https://www.cve.org/CVERecord?id=CVE-2026-42235
Post summary
The CVE-2026-42235 vulnerability in n8n allows unauthenticated attackers to register malicious OAuth clients in versions prior to 1.123.32, 2.17.4, and 2.18.1, and the issue has been addressed in later releases.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | n8n | n8n | - | node.js | - |
| App | n8n | n8n | 2.18.0 | node.js | - |