Missing Authentication for Critical Function in n8n - #VU146795
Published: September 2, 2026
Vulnerability identifier: #VU146795
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to send spoofed webhook deliveries.
The vulnerability exists due to improper authentication in GitHub Trigger webhook signature verification when reusing an existing webhook after a 422 create response. A remote attacker can send crafted requests to the workflow webhook URL to send spoofed webhook deliveries.
The issue occurs when a webhook for the URL already exists and the generated signing secret is not stored, causing signature verification to fail open.
Affected software
n8n
Remediation
Install security update from vendor's website.
n8n - addressed in versions 1.123.76, 2.37.7, 2.38.2