What is the CVSS score of CVE-2026-21894?

CVE-2026-21894 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of N8n are affected by CVE-2026-21894?

Organizations using versions from 0.150.0 to should be aware of notable risk from CVE-2026-21894 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-21894?

Within 30 days: Identify affected systems running versions from 0.150.0 to and apply vendor patches as part of regular patch cycle. Vendor patch is available.

N8n CVE-2026-21894

MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-01-08 security-advisories@github.com

GHSA-jf52-3f2h-h9j5

Authentication Bypass N8n

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 20, 2026 - 15:09 nvd

Patch available

CVE Published

Jan 08, 2026 - 10:15 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stripe webhook signing secret when registering the webhook endpoint, but incoming webhook requests were not verified against this secret. As a result, any HTTP client that knows the webhook URL could send a POST request containing a matching event type, causing the workflow to execute as if a legitimate Stripe event had been received. This issue affects n8n users who have active workflows using the Stripe Trigger node. An attacker could potentially fake payment or subscription events and influence downstream workflow behavior. The practical risk is reduced by the fact that the webhook URL contains a high-entropy UUID; however, authenticated n8n users with access to the workflow can view this webhook ID. This issue has been patched in version 2.2.2. A temporary workaround for this issue involves users deactivating affected workflows or restricting access to workflows containing Stripe Trigger nodes to trusted users only.

AnalysisAI

n8n versions 0.150.0 through 2.2.1 lack webhook signature verification in the Stripe Trigger node, enabling unauthenticated attackers to forge Stripe events and trigger workflows by sending crafted POST requests to known webhook URLs. Affected users with active Stripe Trigger workflows could experience unauthorized execution of automation logic, potentially allowing attackers to simulate fraudulent payment or subscription events. A patch is available in version 2.2.2 and later.

Technical ContextAI

Classified as CWE-290 (Authentication Bypass by Spoofing). Affects N8N. n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stripe webhook signing secret when registering the webhook endpoint, but incoming webhook requests were not verified against this secret. As a result, any HTTP client that knows the webhook URL could send a