CVE-2026-42235

creationtimestamp| type| source ---|---|--- 2026-05-04 21:11:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2lkclquk2r...

CVE-2026-42235 n8n: XSS via MCP OAuth client

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted clientname. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that...