n8n patches an open redirect in its unauthenticated MCP OAuth endpoint

n8n disclosed and fixed a moderate-severity open redirect vulnerability in the OAuth registration endpoint used by its Model Context Protocol (MCP) integration, according to the GitHub Security Advisory for GHSA-pc28-gvgp-xg9x, published on November 13, 2026.

What changed

• Advisory GHSA-pc28-gvgp-xg9x (CVE-2026-126386) was published on November 13, 2026.
• The issue is rated Moderate severity with a CVSS score of 5.1 and classified as CWE-601, URL redirection to an untrusted site.
• The unauthenticated MCP OAuth dynamic client registration endpoint, /mcp-oauth/register, did not validate the redirect_uri parameter.
• An attacker could exploit the flaw to redirect users to an attacker-controlled site during the OAuth flow, enabling phishing.
• Affected versions are 1.x below 1.123.89, 2.x below 2.45.5, 2.46.x below 2.46.1, and 3.x below 3.0.1.
• n8n fixed the vulnerability in the corresponding point release for each affected branch.

What it means for AI builders

n8n is a widely deployed workflow automation platform that now exposes MCP endpoints so AI agents can connect to it directly. An unauthenticated open redirect inside that OAuth flow is a concrete phishing risk for any team that wired MCP into its n8n instance, since users could be sent to a malicious site in the middle of what looks like a normal authorization step.

Fix and next steps

Teams running n8n with MCP enabled should update to the fixed point release for their branch: 1.123.89, 2.45.5, 2.46.1, or 3.0.1 depending on which major version they run. Because the flawed endpoint required no authentication, upgrading is the only way to close the phishing path it opened.

Sources

• n8n MCP OAuth dynamic client registration open redirect (GitHub Security Advisories, November 13, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.