CVE-2026-103245: n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.80 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.39.6 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.40.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running n8n versions earlier than 1.123.80, versions from 2.0.0 through earlier than 2.39.6, or versions from 2.40.0 through earlier than 2.40.1 are affected when they use the Webflow Trigger node.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to send a forged request to the Webflow Trigger webhook endpoint with an attacker-controlled payload.
What could forged webhook requests do?
They can trigger workflows that rely on the Webflow Trigger node and influence downstream actions. The advisory specifically identifies actions such as record creation and API calls.
What versions remediate the issue?
Upgrade to 1.123.80 or later in the 1.x line, 2.39.6 or later in the 2.x line before 2.40.0, or 2.40.1 or later for the 2.40.x line.