CVE-2026-56360CWE-290

n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger

Medium · published July 8, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
EPSS
0.00314 · 23.0th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-07-08T13:49Z
EPSS history
Timeline
  • 08 JUL 13:49Z
    n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger
    cvelistv5