CVE-2026-86080: CWE-347: Improper Verification of Cryptographic Signature in n8n-io n8n

The vulnerability in n8n's GitHub Trigger node arises when the webhook secret generated during webhook creation is discarded if GitHub returns an HTTP 422 error and the node reuses an existing webhook. This leads to workflow static data retaining a webhookId without the corresponding webhookSecret. Consequently, the X-Hub-Signature-256 verification process accepts webhook deliveries without a stored secret, effectively bypassing signature verification. The affected code includes the file packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts and the logic path handling the 422 webhook reuse. The issue is fixed in versions 1.123.76, 2.37.7, and 2.38.2.

An attacker could potentially send webhook deliveries that bypass signature verification, which may allow unauthorized or spoofed webhook events to be accepted by the n8n platform. This could lead to unauthorized workflow executions or other unintended actions triggered by malicious webhook payloads. The CVSS 4.0 base score is 6.3, indicating a medium severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on integrity.

This vulnerability is fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.