Vulnerability · Published Jun 22, 2026 · Assigned by VulnCheck

CVE-2026-56357n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger

Medium 4.0

In plain English

A medium-severity authentication bypass by spoofing in n8n from n8n. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.3%top 75.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	n8n	1.123.15	GHSA-mqpr-49jj-32rc
npm	n8n	2.5.0	GHSA-mqpr-49jj-32rc

Affected products (as reported)

Vendor	Product	Versions
n8n	n8n	0 – before 1.123.152.0.0 – before 2.5.0

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-mqpr-49jj-32rc) vendor-advisory
VulnCheck Advisory: n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger third-party-advisory