Executive brief
n8n is a low-code automation and workflow platform that allows users to integrate business applications via nodes, including payment processors like Stripe. The Stripe Trigger node fails to verify the authenticity of incoming webhook requests. An unauthenticated attacker who discovers a webhook URL can forge Stripe payment or subscription events to trigger arbitrary workflows, potentially manipulating downstream business logic or data processing.
Technical details
The vulnerability is an authentication bypass (CWE-290) in the Stripe Trigger node where incoming webhook POST requests are not cryptographically verified against the stored Stripe webhook signing secret. The Stripe Trigger correctly creates and stores the secret upon webhook registration, but fails to validate the Stripe-Signature header on incoming requests. The attack requires knowledge of the webhook URL, which contains a high-entropy UUID but is accessible to authenticated n8n users with workflow visibility. An attacker can craft a POST request with a matching event type to execute the workflow without proper authentication. The issue has been patched in n8n version 2.2.2 and affects versions 0.150.0 through 2.2.1.
Affected products
- n8n n8n 0.150.0 to 2.2.1
Timeline
- 2026-01-07: disclosed: GHSA-jf52-3f2h-h9j5 published
- 2026-01-07: patched: Fix released in n8n 2.2.2