Authentication Bypass in n8n Workflows via Stripe Trigger Node

CVE-2026-21894

What is CVE-2026-21894?

An authentication bypass vulnerability exists in the n8n workflow automation platform affecting versions from 0.150.0 to before 2.2.2. This issue arises within the Stripe Trigger node, which fails to verify incoming webhook requests against a stored Stripe webhook signing secret. Consequently, unauthenticated actors can send crafted Stripe webhook events to trigger workflows as though they originated from genuine Stripe events. This raises significant security risks, particularly for workflows reliant on the Stripe Trigger, exposing them to potential exploitation, including the manipulation of payment or subscription events. Users can mitigate risks by upgrading to version 2.2.2 or by restricting access to workflows that employ the Stripe Trigger node.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References