Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118679n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger

High 7.5

In plain English

A high-severity server-side request forgery in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 80.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	0 – before 1.123.83
n8n-io	n8n	2.42.0 – before 2.42.1
n8n-io	n8n	2.0.0 – before 2.41.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-3c3p-5959-3ghr) vendor-advisory
VulnCheck Advisory: n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger third-party-advisory