CVE-2026-86080

Undergoing Analysis Undergoing Analysis - In Progress

Authentication Bypass in n8n Workflow Automation

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and X-Hub-Signature-256 verification accepted deliveries without a stored secret. The affected logic includes packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts and the 422 webhook reuse path. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86080

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	From 2.38.0 (inc) to 2.38.2 (exc)
n8n	n8n	to 1.123.76 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.37.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

The vulnerability in n8n's GitHub Trigger node involves a flaw in webhook secret handling. When GitHub returns an HTTP 422 error indicating an existing webhook, the system reuses the remote hook but fails to store the generated signing secret. This causes the webhook to accept deliveries without verifying signatures, potentially allowing unauthorized access.

Impact Analysis

This vulnerability could allow attackers to send unauthorized requests to your n8n workflows by bypassing signature verification. If exploited, it may lead to data breaches, unauthorized workflow execution, or integration with malicious services. Users should update to patched versions immediately.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR's integrity principle or HIPAA's security rule by allowing unauthorized access to sensitive data processed by n8n workflows. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Update n8n to version 1.123.76, 2.37.7, or 2.38.2 or later to address the vulnerability. Temporarily mitigate by reactivating workflows, restricting network access to the GitHub Trigger node, or auditing workflows for missing webhook secrets.

Hi! I’m here to help you understand CVE-2026-86080. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70