PT-2026-50174 · N8N · N8N

Jjjutla + 1 · CVE-2026-54308 · Published 2026-06-16 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.25.7 n8n versions prior to 2.26.2

Description The MicrosoftAgent365Trigger and StripeTrigger nodes fail to validate inbound requests. This allows an unauthenticated attacker with knowledge of the webhook URL to submit a forged payload, triggering workflow execution with attacker-controlled data.

Recommendations Update to version 2.25.7 or later. Update to version 2.26.2 or later. Deactivate any workflows using the MicrosoftAgent365Trigger or StripeTrigger nodes as a temporary measure. Restrict network access to the n8n webhook endpoint to trusted sources only.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-54308

GHSA-JVC7-762P-3743

Affected Products

N8N

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54308.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-jvc7-762p-3743 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jvc7-762p-3743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54308 · Security Note
• https://osv.dev/vulnerability/CVE-2026-54308 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-54308 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://t.me/cveNotify/176488 · Telegram Post