EUVD-2026-74276
GHSA-5m98-cgcr-xx3q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required precondition (prior 422 reuse leaving no stored secret); impact is integrity-only and low, as forged events trigger workflows but do not breach confidentiality or availability.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and X-Hub-Signature-256 verification accepted deliveries without a stored secret. The affected logic includes packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts and the 422 webhook reuse path. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
AnalysisAI
Webhook signature verification in n8n's GitHub Trigger node fails open when GitHub returns HTTP 422 during webhook registration, causing the platform to reuse an existing webhook while silently discarding the generated secret. Workflow static data then retains a webhookId with no corresponding webhookSecret, and the X-Hub-Signature-256 validation logic accepts any inbound delivery unconditionally, allowing network attackers to inject forged GitHub events and trigger arbitrary workflow executions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must both be met: (1) the target n8n GitHub Trigger node must have previously registered a webhook where GitHub responded with HTTP 422 (webhook URL already exists), causing the node to reuse the existing webhook without writing a webhookSecret into static data - workflows registered successfully on first attempt retain a valid secret and are not vulnerable; (2) the attacker must know or discover the n8n webhook endpoint URL, which is deterministic based on the instance base URL and workflow/node identifiers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 correctly characterizes this as a medium-severity integrity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade n8n to version 1.123.76 or later (v1.x), 2.37.7 or later (v2.x), or 2.38.2 or later (v2.38.x). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Share
External POC / Exploit Code
Leaving vuln.today