Is there a patch available for CVE-2026-56357?

Yes, a patch is available for CVE-2026-56357. Update the affected software to the latest version immediately.

n8n CVE-2026-56357

Q: What is the CVSS score of CVE-2026-56357?

CVE-2026-56357 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38377 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-06-22 VulnCheck

Authentication Bypass N8n

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AC:H reflects the attack requirement of knowing the non-public webhook URL; no authentication, no confidentiality or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 22, 2026 - 23:02 EUVD

Source Code Evidence Fetched

Jun 22, 2026 - 22:23 vuln.today

Analysis Generated

Jun 22, 2026 - 22:23 vuln.today

DescriptionCVE.org

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.

AnalysisAI

Webhook forgery in n8n's GitHub Webhook Trigger node allows unauthenticated remote attackers to spoof GitHub events and trigger arbitrary workflow execution by sending unsigned POST requests to any known webhook URL. The root cause is a complete absence of HMAC-SHA256 signature verification - the cryptographic control GitHub provides specifically to authenticate webhook deliveries - meaning n8n accepted all inbound POST traffic without validation. Affected versions span the v1 branch (below 1.123.15) and v2 branch (2.0.0 through 2.5.0); no public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially executable by any party possessing the webhook URL.

Technical ContextAI

n8n is a Node.js-based workflow automation platform (npm package: n8n, CPE: cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*) that exposes webhook endpoints for triggering automation workflows from external services. GitHub's webhook delivery mechanism includes an X-Hub-Signature-256 header containing an HMAC-SHA256 digest of the POST body, keyed with a shared secret configured at webhook registration time. CWE-290 (Authentication Bypass by Spoofing) describes precisely this failure mode: the receiving system neglects to validate the cryptographic proof of origin, allowing any sender to impersonate the trusted party. Because n8n workflows can invoke downstream APIs, databases, and shell commands depending on configuration, accepting arbitrary spoofed payloads can result in unintended workflow execution with attacker-controlled input data.

RemediationAI

Vendor-released patches are available: upgrade to n8n 1.123.15 (v1 branch) or n8n 2.5.0 (v2 branch) per the GHSA-mqpr-49jj-32rc advisory. The underlying fix commits are https://github.com/n8n-io/n8n/commit/a19347a6bc9a96d5065ac77d25a811e46178c578 and https://github.com/n8n-io/n8n/commit/afe322325502f448b33bff1db1575e4447c28a36. If immediate upgrade is not feasible, the vendor recommends two compensating controls: first, restrict workflow creation and editing permissions to fully trusted users only, which limits the blast radius of spoofed triggers but does not prevent them; second, restrict network-layer access to the n8n webhook endpoint to GitHub's published webhook IP ranges, which effectively blocks unauthorized senders but requires ongoing maintenance as GitHub's IP ranges may change. Both workarounds are explicitly acknowledged by the vendor as incomplete mitigations and should not substitute for patching.