CVE-2026-56360

MEDIUM

n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger

Title source: cna
STIX 2.1

Description

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-38c7-23hj-2wgq)
https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq
Third Party Advisory third-party-advisory
VulnCheck Advisory: n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger
https://www.vulncheck.com/advisories/n8n-webhook-forgery-via-unsigned-post-requests-in-zendesktrigger

Scores

CVSS v3 4.0
EPSS 0.0019
EPSS Percentile 8.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-290
Status published
Products (4)
n8n/n8n < 1.123.18 (2 CPE variants)
n8n/n8n 1.123.18
n8n/n8n 2.0.0 - 2.6.2
n8n/n8n 2.6.2
Published Jul 08, 2026
Tracked Since Jul 08, 2026