CVE-2026-56357: n8n authentication bypass via webhook forgery in GitHub Trigger node

Executive brief

n8n is a workflow automation tool used to connect different software services. A security flaw in its GitHub integration allows unauthorized individuals to trigger automated tasks by sending fake data. This could lead to the execution of unintended business processes or the insertion of incorrect data into connected systems if an attacker knows the specific web address of the automation.

Technical details

The n8n GitHub Webhook Trigger node fails to implement HMAC-SHA256 signature verification for incoming POST requests. This allows an attacker who knows or guesses a workflow's webhook URL to bypass authentication by sending unsigned requests. By spoofing GitHub webhook events, an attacker can trigger workflows with arbitrary payload data. The vulnerability is classified as Authentication Bypass by Spoofing (CWE-290). It has been remediated in versions 1.123.15 and 2.5.0.

Affected products

• n8n-io n8n < 1.123.15, >= 2.0.0, < 2.5.0

Timeline

• 2026-02-25: disclosed
• 2026-02-26: advisory

References

• https://api.github.com/users/simonkoeck
• https://github.com/simonkoeck
• https://api.github.com/users/simonkoeck/gists%7B/gist_id%7D
• https://api.github.com/users/simonkoeck/repos
• https://avatars.githubusercontent.com/u/54739715?v=4
• https://api.github.com/users/simonkoeck/events%7B/privacy%7D