Webhook Security Flaw in n8n Automation Platform
CVE-2026-86080
6.3MEDIUM
What is CVE-2026-86080?
The n8n workflow automation platform suffers from a significant vulnerability where the GitHub Trigger generates a webhook secret but fails to retain it under specific conditions. When the server responds with an HTTP 422 status and the node reuses an existing webhook, it inadvertently omits the critical webhook secret from stored workflow static data. Consequently, this flaw allows an X-Hub-Signature-256 verification to accept incoming deliveries without a valid secret, thereby compromising the integrity of webhook interactions. This issue has been addressed in versions 1.123.76, 2.37.7, and 2.38.2.
Affected Version(s)
n8n >= 2.38.0, < 2.38.2 < 2.38.0, 2.38.2
n8n >= 2.0.0, < 2.37.7 < 2.0.0, 2.37.7
n8n < 1.123.76 < 1.123.76