p PatchFirst

CVE-2026-118679

CVE-2026-118679 · n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger

This page contains facts from public vulnerability sources. Check the original advisory before updating.

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.

CVSS 6.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Affected products and versions

  • n8n

    Versions
    • ≥ 0, < 1.123.83: Affected (semver)
    • 1.123.83: Not affected (semver)

    Update to 1.123.83

  • n8n

    Versions
    • ≥ 2.42.0, < 2.42.1: Affected (semver)
    • 2.42.1: Not affected (semver)

    Update to 2.42.1

  • n8n

    Versions
    • ≥ 2.0.0, < 2.41.4: Affected (semver)
    • 2.41.4: Not affected (semver)

    Update to 2.41.4

Original sources

Check your server →