EUVD-2026-42258
GHSA-wgjf-2hg5-2533
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-public webhook URL prerequisite (AT:P equivalent); integrity-only impact with no scope change beyond n8n accepting forged data.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.
AnalysisAI
Webhook signature bypass in n8n's ZendeskTrigger node allows network-adjacent attackers who possess the webhook URL to inject arbitrary data into n8n workflows by sending unsigned POST requests. The ZendeskTrigger node omits the mandatory HMAC-SHA256 verification step that Zendesk's webhook security model requires, treating any inbound POST as a legitimate Zendesk event. This affects n8n v1.x before 1.123.18 and v2.x before 2.6.2; no public exploit or CISA KEV designation has been identified at time of analysis.
Technical ContextAI
n8n is an open-source workflow automation platform whose ZendeskTrigger node exposes an HTTP webhook endpoint intended to receive events from Zendesk. Zendesk's webhook security model uses HMAC-SHA256 signatures: each outbound request includes a signature header derived from a shared secret so that receivers can authenticate the source. CWE-290 (Authentication Bypass by Spoofing) applies because n8n omits this verification step entirely, relying implicitly on URL secrecy rather than cryptographic proof of origin. Affected CPE-equivalent ranges per EUVD-2026-42258 are n8n 0 through below 1.123.18 and n8n 2.0.0 through below 2.6.2. The CVSS 4.0 AT:P metric correctly captures that exploitation requires the attacker to have already obtained the webhook URL, which is not publicly discoverable by default but can leak through logs, referrer headers, or misconfigured infrastructure.
RemediationAI
Upgrade n8n to version 1.123.18 or later on v1.x deployments, or to version 2.6.2 or later on v2.x deployments; these are the confirmed vendor-released patched versions per the GitHub security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq and supplemental advisory at https://www.vulncheck.com/advisories/n8n-webhook-forgery-via-unsigned-post-requests-in-zendesktrigger. If immediate patching is not feasible, disable all active ZendeskTrigger workflow nodes to eliminate the exposed endpoint - this has the side effect of stopping Zendesk event processing until the patch is applied. As a secondary compensating control, restrict access to the n8n webhook URL at the network or reverse-proxy layer by allowlisting Zendesk's published source IP ranges, though this requires ongoing maintenance as Zendesk IP ranges change and does not substitute for cryptographic signature verification.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today