Is there a patch available for CVE-2026-56360?

Yes, a patch is available for CVE-2026-56360. Update the affected software to the latest version immediately.

n8n CVE-2026-56360

Q: What is the CVSS score of CVE-2026-56360?

CVE-2026-56360 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42258 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-07-08 disclosure@vulncheck.com

GHSA-wgjf-2hg5-2533

Authentication Bypass N8n

6.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AC:H reflects the non-public webhook URL prerequisite (AT:P equivalent); integrity-only impact with no scope change beyond n8n accepting forged data.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 15:06 vuln.today

Patch available

Jul 08, 2026 - 15:01 EUVD

DescriptionCVE.org

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

AnalysisAI

Webhook signature bypass in n8n's ZendeskTrigger node allows network-adjacent attackers who possess the webhook URL to inject arbitrary data into n8n workflows by sending unsigned POST requests. The ZendeskTrigger node omits the mandatory HMAC-SHA256 verification step that Zendesk's webhook security model requires, treating any inbound POST as a legitimate Zendesk event. This affects n8n v1.x before 1.123.18 and v2.x before 2.6.2; no public exploit or CISA KEV designation has been identified at time of analysis.

Technical ContextAI

n8n is an open-source workflow automation platform whose ZendeskTrigger node exposes an HTTP webhook endpoint intended to receive events from Zendesk. Zendesk's webhook security model uses HMAC-SHA256 signatures: each outbound request includes a signature header derived from a shared secret so that receivers can authenticate the source. CWE-290 (Authentication Bypass by Spoofing) applies because n8n omits this verification step entirely, relying implicitly on URL secrecy rather than cryptographic proof of origin. Affected CPE-equivalent ranges per EUVD-2026-42258 are n8n 0 through below 1.123.18 and n8n 2.0.0 through below 2.6.2. The CVSS 4.0 AT:P metric correctly captures that exploitation requires the attacker to have already obtained the webhook URL, which is not publicly discoverable by default but can leak through logs, referrer headers, or misconfigured infrastructure.

RemediationAI

Upgrade n8n to version 1.123.18 or later on v1.x deployments, or to version 2.6.2 or later on v2.x deployments; these are the confirmed vendor-released patched versions per the GitHub security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq and supplemental advisory at https://www.vulncheck.com/advisories/n8n-webhook-forgery-via-unsigned-post-requests-in-zendesktrigger. If immediate patching is not feasible, disable all active ZendeskTrigger workflow nodes to eliminate the exposed endpoint - this has the side effect of stopping Zendesk event processing until the patch is applied. As a secondary compensating control, restrict access to the n8n webhook URL at the network or reverse-proxy layer by allowlisting Zendesk's published source IP ranges, though this requires ongoing maintenance as Zendesk IP ranges change and does not substitute for cryptographic signature verification.