Missing Authentication for Critical Function in n8n - CVE-2026-126382
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU163073
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126382
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to trigger n8n workflows with forged Asana events and prevent genuine deliveries from being accepted.
The vulnerability exists due to the Asana Trigger accepting a replacement webhook verification secret from any request carrying an X-Hook-Secret header without authentication. An unauthenticated attacker can use a known webhook URL to replace the secret and submit attacker-controlled events that pass signature verification.
Affected software
n8n
How to mitigate CVE-2026-126382
Install security update from vendor's website.
n8n - addressed in versions 2.38.0, 3.0.1