{"id":"EUVD-2026-42258","enisaUuid":"00bbc237-dac9-3748-b502-6c7183df20ac","description":"n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.","datePublished":"Jul 8, 2026, 1:49:03 PM","dateUpdated":"Jul 8, 2026, 2:26:33 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq\nhttps://www.vulncheck.com/advisories/n8n-webhook-forgery-via-unsigned-post-requests-in-zendesktrigger\n","aliases":"CVE-2026-56360\nGHSA-wgjf-2hg5-2533\n","assigner":"VulnCheck","epss":0.31,"enisaIdProduct":[{"id":"a4cfa0d2-65cc-3e51-9666-c026d08116aa","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0 \u003c2.6.2"},{"id":"deb062c3-f20b-34ea-9a51-98bcd97deb10","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.18"}],"enisaIdVendor":[{"id":"a0375e87-92e5-3c98-9f66-f593d9b892e0","vendor":{"name":"n8n"}}],"enisaIdVulnerability":[{"id":"da577b1b-28f5-3c33-a37b-96fa91084f47","vulnerability":{"id":"GHSA-wgjf-2hg5-2533","description":"n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.","datePublished":"Jul 8, 2026, 3:32:01 PM","dateUpdated":"Jul 8, 2026, 3:32:01 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56360\nhttps://www.vulncheck.com/advisories/n8n-webhook-forgery-via-unsigned-post-requests-in-zendesktrigger\n","enisa_id":"EUVD-2026-42258\n","aliases":"GHSA-wgjf-2hg5-2533\nCVE-2026-56360\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f583a139-9780-39db-b8ba-e7345b9184ee","vulnerability":{"id":"CVE-2026-56360","description":"n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.","datePublished":"Jul 8, 2026, 1:49:03 PM","dateUpdated":"Jul 8, 2026, 2:26:33 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq\nhttps://www.vulncheck.com/advisories/n8n-webhook-forgery-via-unsigned-post-requests-in-zendesktrigger\n","enisa_id":"EUVD-2026-42258\n","assigner":"VulnCheck","epss":0.31,"dataProcessed":"Nov 1, 2026, 7:17:53 AM","vulnerabilityProduct":[{"id":"72d7b062-5d46-3cd8-a389-5810ddb9da5c","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.18"},{"id":"d782461a-3d00-3ef9-9935-1a7e4f351fd7","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0 \u003c2.6.2"}],"vulnerabilityVendor":[{"id":"fec6eade-4fbe-3938-a48a-6b7316d08141","vendor":{"name":"n8n"}}]}}],"enisaIdAdvisory":[{"id":"2c872a68-c371-372f-a60f-e31a19589e73","advisory":{"id":"NCSC-2026-0248","description":"Kwetsbaarheden verholpen in n8n workflow automation platform","datePublished":"Jul 17, 2026, 2:31:46 PM","dateUpdated":"Jul 17, 2026, 2:31:46 PM","baseScore":0.0,"references":"","aliases":"CVE-2026-27493\nCVE-2026-27494\nCVE-2026-27495\nCVE-2026-27497\nCVE-2026-27498\nCVE-2026-27577\nCVE-2026-27578\nCVE-2026-56357\nCVE-2026-56350\nCVE-2026-56360\nCVE-2026-56349\nCVE-2026-56353\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"364a8433-3afa-3542-89ea-53fe6c29c226","product":{"name":"n8n","vendor":{"name":"n8n-io"}}}]}}]}