Executive brief
n8n is a workflow automation platform that integrates with GitHub via webhooks to trigger automated actions. When registering a GitHub webhook, n8n generates a signing secret to verify that incoming webhook deliveries genuinely originate from GitHub. A flaw in the 422 error handling path causes n8n to discard this secret when GitHub rejects webhook creation due to a duplicate URL, allowing unauthenticated attackers to forge webhook deliveries and trigger workflows without authorization.
Technical details
This is a cryptographic verification bypass (CWE-347) in n8n's GitHub Trigger node. When n8n registers a webhook with GitHub, it generates a signing secret and validates incoming X-Hub-Signature-256 headers against it. However, when GitHub responds with a 422 status (indicating a webhook for that URL already exists), the node reuses the remote webhook but only stores its id and events—discarding the locally generated secret. Subsequent webhook deliveries to that URL are then accepted without signature verification, since no secret is available to validate against. The attack requires the attacker to know the target n8n instance's webhook URL and have network access to POST forged webhook payloads to it. The patch re-fetches the existing hook by ID, re-applies the signing secret, and enforces strict verification (fail-closed) when no secret is stored. Patches are available in versions 1.123.76, 2.37.7, and 2.38.2.
Affected products
- n8n n8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2
Timeline
- 2026-09-02: disclosed: Advisory published via GitHub Security Advisory (GHSA-5m98-cgcr-xx3q)
- 2026-09-02: patched: Fixed in versions 1.123.76, 2.37.7, and 2.38.2