{"id":"EUVD-2026-38473","enisaUuid":"6f9f2899-5898-39d4-8a65-e9771e625505","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.","datePublished":"Jun 23, 2026, 3:42:39 PM","dateUpdated":"Jun 24, 2026, 1:59:08 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jvc7-762p-3743\n","aliases":"CVE-2026-54308\nGHSA-jvc7-762p-3743\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"19738cfe-9992-318f-9a38-8a1a16d6f809","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.25.7"},{"id":"7685d96b-11d1-3ce0-ac72-db2ac6724351","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.2"}],"enisaIdVendor":[{"id":"6e63c090-eff2-33f5-b647-c6c51059d17c","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"5ab9ee60-7a9a-383a-979e-35728b4cfd80","vulnerability":{"id":"GHSA-jvc7-762p-3743","description":"n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes","datePublished":"Jun 16, 2026, 7:00:13 PM","dateUpdated":"Jul 20, 2026, 1:43:47 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jvc7-762p-3743\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54308\nhttps://github.com/n8n-io/n8n\n","enisa_id":"EUVD-2026-38473\n","aliases":"CVE-2026-54308\nGHSA-jvc7-762p-3743\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5c73574d-8752-31dd-bb20-aaa4a7cc0f23","vulnerability":{"id":"CVE-2026-54308","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.","datePublished":"Jun 23, 2026, 3:42:39 PM","dateUpdated":"Jun 24, 2026, 1:59:08 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jvc7-762p-3743\n","enisa_id":"EUVD-2026-38473\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Oct 28, 2026, 7:16:10 AM","vulnerabilityProduct":[{"id":"668aec0b-35bd-344c-ac45-cdf2c1bb9050","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.2"},{"id":"c0f758e8-d2e0-3708-845b-bf463cc3ca0c","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.25.7"}],"vulnerabilityVendor":[{"id":"bef6f46f-21bc-37da-bc73-ec013d535a53","vendor":{"name":"n8n-io"}}]}}],"enisaIdAdvisory":[{"id":"a63dc2c5-b06c-3384-9dc4-30994790a6c1","advisory":{"id":"NCSC-2026-0212","description":"Kwetsbaarheden verholpen in n8n workflow automation platform","datePublished":"Jun 29, 2026, 8:02:42 AM","dateUpdated":"Jun 29, 2026, 8:02:42 AM","baseScore":0.0,"references":"","aliases":"CVE-2026-54301\nCVE-2026-54302\nCVE-2026-54304\nCVE-2026-54305\nCVE-2026-54306\nCVE-2026-54307\nCVE-2026-54308\nCVE-2026-54309\nCVE-2026-54310\nCVE-2026-54311\nCVE-2026-54312\nCVE-2026-54313\nCVE-2026-54314\nCVE-2026-54303\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"9b0181f2-7f6b-3f30-80cf-cc01cf736196","product":{"name":"n8n","vendor":{"name":"n8n-io"}}}]}}]}