Description
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| n8n | n8n | < 1.123.18, 2.0.0 – < 2.6.2 | 1.123.18 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | n8n | < 1.123.18 | 1.123.18 | GHSA-38c7-23hj-2wgq |
| npm | n8n | >= 2.0.0, < 2.6.2 | 2.6.2 | GHSA-38c7-23hj-2wgq |
Advisories 2
- NCSC-2026-0248 Kwetsbaarheden verholpen in n8n workflow automation platform NCSC-NL (Netherlands) · Jul 17, 2026
- WID-SEC-2026-0532 n8n: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2026
References
- GitHub Security Advisory (GHSA-38c7-23hj-2wgq) vendor-advisory
- VulnCheck Advisory: n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger third-party-advisory