PT-2026-51415 · N8N · N8N

Simonkoeck · Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-56357

NVD

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-56357

Affected Products

N8N

References · 3

• https://github.com/n8n-io/n8n/security/advisories/GHSA-mqpr-49jj-32rc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56357 · Security Note
• https://vulncheck.com/advisories/n8n-webhook-forgery-via-missing-hmac-sha256-signature-verification-in-github-webhook-trigger · Note