CVE-2026-126382: n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset
n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accepts a new webhook verification secret from any request carrying an X-Hook-Secret header. Unauthenticated attackers who know the webhook URL can replace the secret, send forged Asana events that pass signature verification, and trigger workflows with attacker-controlled data while genuine deliveries are rejected.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running n8n versions before 2.38.0 or 3.x versions before 3.0.1 are affected if they use an Asana Trigger webhook whose URL can be known by an attacker.
What does an attacker need to exploit this issue?
An attacker does not need authentication, but must know the Asana Trigger webhook URL. They can send a request with an X-Hook-Secret header to replace the verification secret, then submit forged events that pass signature verification.
What is the operational impact of exploitation?
An attacker can trigger workflows using attacker-controlled Asana event data. Replacing the secret also causes legitimate Asana webhook deliveries to be rejected.
How can I tell whether a webhook may already have been compromised?
Look for unexpected requests to the Asana Trigger webhook carrying an X-Hook-Secret header, forged or unexplained workflow executions, and failures of genuine Asana deliveries caused by a changed verification secret.