CVE-2026-56357 — MEDIUM (4.0)

Q: How severe is CVE-2026-56357?

CVE-2026-56357 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-56357?

Check the references section above for vendor advisories and patch information. Affected products include: N8N N8N.

Vulnerability Description

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary data, spoofing GitHub webhook events.

CVSS Score

4.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
N8N	N8N	< 1.123.15

Related Weaknesses (CWE)

CWE-290

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-mqpr-49jj-32rcVendor Advisory
https://www.vulncheck.com/advisories/n8n-webhook-forgery-via-missing-hmac-sha256Third Party Advisory

FAQ

What is CVE-2026-56357?

CVE-2026-56357 is a vulnerability with a CVSS score of 4.0 (MEDIUM). n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers who know the webhook URL...

How severe is CVE-2026-56357?

CVE-2026-56357 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-56357?

Check the references section above for vendor advisories and patch information. Affected products include: N8N N8N.