PT-2026-51415 · N8N · N8N

Simonkoeck · Publicado 2026-06-22 · Atualizado 2026-06-22 · CVE-2026-56357

NVD

CVSS v3.1

4.0

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.

Correção

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2026-56357

Produtos afetados

N8N

Referências · 3

• https://github.com/n8n-io/n8n/security/advisories/GHSA-mqpr-49jj-32rc · Aviso do Fabricante
• https://vulncheck.com/advisories/n8n-webhook-forgery-via-missing-hmac-sha256-signature-verification-in-github-webhook-trigger · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56357 · Nota de Segurança