CVE-2026-56357

MEDIUM

n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger

Title source: cna
STIX 2.1

Description

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-mqpr-49jj-32rc)
https://github.com/n8n-io/n8n/security/advisories/GHSA-mqpr-49jj-32rc
Third Party Advisory third-party-advisory
VulnCheck Advisory: n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger
https://www.vulncheck.com/advisories/n8n-webhook-forgery-via-missing-hmac-sha256-signature-verification-in-github-webhook-trigger

Scores

CVSS v3 4.0
EPSS 0.0019
EPSS Percentile 8.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-290
Status published
Products (6)
n8n/n8n < 1.123.15 (3 CPE variants)
n8n/n8n 1.123.15
n8n/n8n 2.0.0 - 2.5.0
n8n/n8n 2.5.0
npm/n8n 0 - 1.123.15npm
npm/n8n 2.0.0 - 2.5.0npm
Published Jun 22, 2026
Tracked Since Jun 23, 2026