PT-2026-2124 · Stripe+1 · Stripe+1

Jjjutla + 1 · Published 2026-01-07 · Updated 2026-04-22 · CVE-2026-21894

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions n8n versions 0.150.0 through 2.2.1

Description n8n is a workflow automation platform. A flaw in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger node creates a Stripe webhook signing secret when registering the webhook endpoint, but incoming webhook requests were not verified against this secret. Consequently, any HTTP client with knowledge of the webhook URL can send a POST request with a matching event type, causing the workflow to execute as if a legitimate Stripe event occurred. This impacts n8n users with active workflows utilizing the Stripe Trigger node. An attacker could potentially simulate payment or subscription events, influencing downstream workflow behavior. The risk is lessened by the webhook URL containing a high-entropy UUID, though authenticated n8n users with workflow access can view this ID. The affected component is the Stripe Trigger node.

Recommendations Versions 0.150.0 through 2.2.1 should be updated to version 2.2.2 or later. As a temporary workaround, deactivate affected workflows. Restrict access to workflows containing Stripe Trigger nodes to trusted users only.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-21894

GHSA-JF52-3F2H-H9J5

Affected Products

Stripe

N8N

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21894.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5 · Vendor Advisory
• https://github.com/n8n-io/n8n/commit/a61a5991093c41863506888336e808ac1eff8d59 · Patch
• https://github.com/n8n-io/n8n/pull/22764 · Patch
• https://osv.dev/vulnerability/CVE-2026-21894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21894 · Security Note
• https://osv.dev/vulnerability/GHSA-jf52-3f2h-h9j5 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/2009208592029884665 · Twitter Post
• https://twitter.com/jan_voldan/status/2046957718301184306 · Twitter Post
• https://t.me/CVEtracker/41711 · Telegram Post