BaseFortify

Executive Summary

CVE-2026-103245 is a vulnerability in n8n versions before 1.123.80, 2.0.0 before 2.39.6, and 2.40.0 before 2.40.1 where the Webflow Trigger node fails to verify the x-webflow-signature HMAC in webhook handlers. This allows unauthenticated attackers to send forged webhook requests with attacker-controlled payloads, triggering workflows and manipulating downstream actions like record creation or API calls.

Useful 0 Not Useful 0

Detection Guidance

Check if your n8n instance is running a vulnerable version by running: n8n --version. Inspect webhook logs for suspicious requests without valid x-webflow-signature headers. Monitor for unauthorized workflow triggers or unexpected downstream actions like record creation or API calls.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized individuals to manipulate workflows by sending fake webhook requests. This might lead to unintended actions such as creating or modifying records, sending messages, or making unauthorized API calls, potentially causing data breaches or workflow disruptions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data processing or manipulation, which may violate GDPR's integrity and confidentiality principles (Article 5) if personal data is altered or exposed. For HIPAA, it risks unauthorized access to protected health information (PHI) if workflows handle such data, potentially breaching the Security Rule's integrity and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade n8n to a patched version (1.123.80 or later, 2.39.6 or later, or 2.40.1 or later). Temporarily deactivate affected Webflow Trigger workflows until patched. Restrict network access to the webhook endpoint using firewalls or network policies. Limit n8n instance access to trusted users only.

Useful 0 Not Useful 0