n8n CVE-2026-118679

Exploitation requires that no Signature Secret is configured on the Slack API credential used by the Slack Trigger node - this is the fail-open condition, since the signing secret is an optional field and the check returns success when absent. The attacker must also know the specific webhook URL of an active Slack Trigger node, and the node's 'Download Files' behavior must be reachable so a caller-named file is fetched with the workspace token attached. Limiting factors that reduce real-world exposure: instances that set a signing secret, that disable the Download Files option, that restrict the webhook endpoint to Slack's published IP ranges, or that enable N8N_SSRF_PROTECTION_ENABLED=true are protected per the vendor; the webhook URL must be known/guessed. Authentication is not required (PR:N confirmed by the CVSS vector).

This is a genuine but moderate-priority issue rather than a drop-everything emergency, and the signals are largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms a network-reachable, unauthenticated flaw, which the description supports: an attacker who knows the Slack Trigger webhook URL can trigger it without credentials. The AT:P (attack requirements present) metric aligns with the real precondition - the flaw only works when no signing secret is configured on the Slack credential and the node's file-download path is reachable, so success depends on target configuration rather than pure attacker control. Impact is split: direct impact to the n8n host is rated low (VC:L/VI:L), but the subsequent-system confidentiality is high (SC:H) because the exfiltrated artifact is a Slack workspace access token that grants access to the connected Slack workspace - this is the core of the risk. There is no CISA KEV listing and no EPSS score in the supplied data, so exploitation probability cannot be quantified from the input; absence of EPSS/KEV is not evidence of safety but means widespread automated exploitation is not demonstrated. No working public exploit is identified - the only references are the n8n GHSA advisory and the VulnCheck advisory, not proof-of-concept code. The vendor/aggregator priority label is 'this_month', consistent with a serious credential-disclosure bug that is not under confirmed active exploitation.

An unauthenticated attacker who has discovered a public n8n Slack Trigger webhook URL on an instance where no Slack signing secret is set sends a crafted request that the node accepts because signature verification fails open. The request names a file to 'download', and n8n attaches the Slack workspace access token to an outbound request to the attacker-chosen host, delivering the token and returning the response. No public proof-of-concept exploit code is identified in the supplied sources.