CVE-2026-86080: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and X-Hub-Signature-256 verification accepted deliveries without a stored secret. The affected logic includes packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts and the 422 webhook reuse path. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8n GitHub Triggerto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8n GitHub Triggerto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8n GitHub Triggerto a version that resolves this vulnerability.Fixed in 2.38.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
n8n deployments running versions earlier than 1.123.76, 2.37.7, or 2.38.2 are affected when a GitHub Trigger receives an HTTP 422 response while creating a webhook and reuses an existing webhook.
What condition causes signature verification to fail open?
The affected 422 reuse path retains the existing webhook ID but does not store the generated webhook secret in workflow static data. As a result, deliveries with an X-Hub-Signature-256 can be accepted without a stored secret for verification.
How can I determine whether a workflow may already be affected?
Check GitHub Trigger workflow static data for a retained webhookId with no corresponding webhookSecret. This state indicates that the webhook reuse path may have occurred and signature verification may fail open.
What versions contain the fix?
The issue is fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2.