Server-Side Request Forgery in n8n Slack Trigger Webhook

CVE-2026-118679

What is CVE-2026-118679?

The vulnerability in n8n exposes a critical risk via its Slack Trigger webhook mechanism. If an attacker knows the specific webhook URL and there is no signing secret in place, they can exploit this flaw to bypass signature verification. This can lead to unauthorized access and exfiltration of sensitive information, such as Slack tokens, by naming a file for download. This manipulation allows the attacker to retrieve the workspace access token and send it to an external server.

References