CVE-2026-54308CWE-290

n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node

Medium · published June 23, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-06-23T15:42Z
EPSS history
Timeline
  • 23 JUN 15:42Z
    n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node
    cvelistv5