Unrated severityNVD Advisory· Published Jul 8, 2026· Updated Jul 8, 2026
n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger
CVE-2026-56360
Description
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgqmitrevendor-advisory
- www.vulncheck.com/advisories/n8n-webhook-forgery-via-unsigned-post-requests-in-zendesktriggermitrethird-party-advisory
News mentions
0No linked articles in our index yet.