The MCP OAuth client registration endpoint in n8n accepts unauthenticated requests and stores community data without enforcing resource limits. By repeatedly submitting large payloads, an attacker can consume server memory until the process crashes or becomes unresponsive, causing a denial of service. This flaw is a classic case of resource exhaustion (CWE‑770).

Affected products are n8n—the open‑source workflow automation platform—specifically any instance running a version older than 1.123.32, 2.17.4 or 2.18.1. All releases prior to those patch versions remain vulnerable. Users of newer major releases are not impacted by this advisory but should verify similar endpoints for proper limits.

The CVSS score of 8.7 indicates a high impact vulnerability with remote unauthenticated exploitation. No EPSS score is available, so the likelihood of active exploitation is unknown; the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a simple HTTP POST to the registration endpoint from any IP address, meaning an external attacker can trigger the denial of service without authentication.