CVE-2026-56357n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger

6.3MediumCVSS base score
0.31%Exploitation in 30 daysEPSS · top 75% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.

Timeline

2026
20 Jun 2026
20 Jun 2026
ID reserved
By VulnCheck
22 Jun 20262 days later
22 Jun 2026· 2 days later
Published
23 Jun 20261 day later
23 Jun 2026· 1 day later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-56357, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
VulnCheckCNA (assigner)	3.1	Medium4.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
NVDNVD · Analyzed	4.0	Medium6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.31% · top 75% of all CVEs (13 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Affected products

n8n · n8n
- affected < 1.123.15
- unaffected 1.123.15
- affected 2.0.0 – < 2.5.0
- unaffected 2.5.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

npmn8nGHSA-mqpr-49jj-32rc (opens in a new tab)

References2

GitHub Security Advisory (GHSA-mqpr-49jj-32rc) (opens in a new tab)vendor-advisory
VulnCheck Advisory: n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-56357](https://cveledger.app/badge/CVE-2026-56357.svg)](https://cveledger.app/cve/CVE-2026-56357)

Record last updated 23 Jun 2026, 14:25 UTC.