p PatchFirst

CVE-2026-56360

CVE-2026-56360 · n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger

This page contains facts from public vulnerability sources. Check the original advisory before updating.

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

CVSS 6.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • n8n

    Versions
    • ≥ 0, < 1.123.18: Affected (semver)
    • 1.123.18: Not affected (semver)
    • ≥ 2.0.0, < 2.6.2: Affected (semver)
    • 2.6.2: Not affected (semver)

    Update to 1.123.18; Update to 2.6.2

  • n8n npm

    Affected ranges
    • SEMVER: < 1.123.18

    Update to 1.123.18

  • n8n npm

    Affected ranges
    • SEMVER: ≥ 2.0.0, < 2.6.2

    Update to 2.6.2

Original sources

Check your server →