CVE-2026-56357

n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger

State: Published
Severity: 6.3 Medium
Published: Jun 22, 2026
Updated: Jun 23, 2026
Reserved: Jun 20, 2026

Description

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N	VulnCheck
3.1	4.0 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-290 Authentication Bypass by Spoofing

Affected Products

Product	Versions
n8nn8n	before 1.123.15Affected 1.123.15Not affected 2.0.0 to before 2.5.0Affected 2.5.0Not affected

References

GitHub Security Advisory (GHSA-mqpr-49jj-32rc)vendor-advisory
VulnCheck Advisory: n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Triggerthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.