n8n: Webhook Forgery on Github Webhook Trigger (CVE-2026-56357)
n8n versions prior to 1.123.15 and versions from 2.0.0 up to but not including 2.5.0 contain a vulnerability in the GitHub Webhook Trigger node. This flaw allows an attacker who knows the webhook URL to send unsigned POST requests, triggering workflows with arbitrary data because the node lacks HMAC-SHA256 signature verification. The vulnerability has been fixed in versions 1.123.15 and 2.5.0 and later. Temporary mitigations include restricting workflow editing permissions and limiting network access to known GitHub IP ranges, but these do not fully eliminate the risk.
AI Analysis
Technical Summary
The GitHub Webhook Trigger node in n8n does not verify the HMAC-SHA256 signature that GitHub provides to authenticate webhook deliveries. As a result, an attacker aware of the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, effectively spoofing GitHub webhook events. This vulnerability is identified as CVE-2026-56357 and affects n8n versions before 1.123.15 and versions from 2.0.0 up to 2.5.0. The issue has been addressed in n8n versions 1.123.15 and 2.5.0 and later.
Potential Impact
An attacker can trigger workflows in n8n by sending forged GitHub webhook requests without valid signatures. This could lead to unauthorized execution of workflows with attacker-controlled data, potentially disrupting automated processes or causing unintended actions within the affected environment.
Mitigation Recommendations
A fix is available in n8n versions 1.123.15 and 2.5.0 and later; users should upgrade to these versions or newer to remediate the vulnerability. If immediate upgrade is not possible, administrators should limit workflow creation and editing permissions to trusted users and restrict network access to the webhook endpoint to known GitHub webhook IP ranges. These workarounds are temporary and do not fully mitigate the risk.
n8n: Webhook Forgery on Github Webhook Trigger (CVE-2026-56357)
Description
n8n versions prior to 1.123.15 and versions from 2.0.0 up to but not including 2.5.0 contain a vulnerability in the GitHub Webhook Trigger node. This flaw allows an attacker who knows the webhook URL to send unsigned POST requests, triggering workflows with arbitrary data because the node lacks HMAC-SHA256 signature verification. The vulnerability has been fixed in versions 1.123.15 and 2.5.0 and later. Temporary mitigations include restricting workflow editing permissions and limiting network access to known GitHub IP ranges, but these do not fully eliminate the risk.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The GitHub Webhook Trigger node in n8n does not verify the HMAC-SHA256 signature that GitHub provides to authenticate webhook deliveries. As a result, an attacker aware of the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, effectively spoofing GitHub webhook events. This vulnerability is identified as CVE-2026-56357 and affects n8n versions before 1.123.15 and versions from 2.0.0 up to 2.5.0. The issue has been addressed in n8n versions 1.123.15 and 2.5.0 and later.
Potential Impact
An attacker can trigger workflows in n8n by sending forged GitHub webhook requests without valid signatures. This could lead to unauthorized execution of workflows with attacker-controlled data, potentially disrupting automated processes or causing unintended actions within the affected environment.
Mitigation Recommendations
A fix is available in n8n versions 1.123.15 and 2.5.0 and later; users should upgrade to these versions or newer to remediate the vulnerability. If immediate upgrade is not possible, administrators should limit workflow creation and editing permissions to trusted users and restrict network access to the webhook endpoint to known GitHub webhook IP ranges. These workarounds are temporary and do not fully mitigate the risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mqpr-49jj-32rc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-56357"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a5bd3182a4a8d5989284fdc
Added to database: 07/18/2026, 19:25:12 UTC
Last enriched: 07/18/2026, 19:26:34 UTC
Last updated: 07/24/2026, 00:47:11 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.