Threats tagged 'ghsa-r9rf-g62g-xq7v'

A server-side request forgery (SSRF) vulnerability exists in n8n versions before 1.123.83, 2.41.4, and 2.42.1 in the Slack Trigger webhook. This flaw allows unauthenticated attackers to bypass signature verification when no signing secret is set, enabling them to exfiltrate Slack workspace access tokens by causing the node to send these tokens to an attacker-controlled host.