CVE-2026-56357CWE-290

n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger

Medium · published June 22, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
EPSS
0.00314 · 23.0th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-06-22T21:04Z
EPSS history
Timeline
  • 22 JUN 21:04Z
    n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger
    cvelistv5