Description
n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| n8n | n8n | < 1.123.15, 2.0.0 – < 2.5.0 | 1.123.15 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | n8n | < 1.123.15 | 1.123.15 | GHSA-mqpr-49jj-32rc |
| npm | n8n | >= 2.0.0, < 2.5.0 | 2.5.0 | GHSA-mqpr-49jj-32rc |
Advisories 2
- NCSC-2026-0248 Kwetsbaarheden verholpen in n8n workflow automation platform NCSC-NL (Netherlands) · Jul 17, 2026
- WID-SEC-2026-0532 n8n: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2026