Medium severity4.0NVD Advisory· Published Jul 8, 2026· Updated Jul 8, 2026
CVE-2026-56360
CVE-2026-56360
Description
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgqnvdMitigationVendor Advisory
- www.vulncheck.com/advisories/n8n-webhook-forgery-via-unsigned-post-requests-in-zendesktriggernvdThird Party Advisory
News mentions
0No linked articles in our index yet.