Vulnerability · Published Jul 8, 2026 · Assigned by VulnCheck
CVE-2026-56360n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger
Medium 4.0
In plain English
A medium-severity authentication bypass by spoofing in n8n from n8n. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.3%top 75.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | n8n | 1.123.18 | GHSA-38c7-23hj-2wgq |
| npm | n8n | 2.6.2 | GHSA-38c7-23hj-2wgq |
Affected products (as reported)
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-38c7-23hj-2wgq) vendor-advisory
- VulnCheck Advisory: n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger third-party-advisory