CVE-2026-103245: n8n Webflow Trigger Authentication Bypass

CVE-2026-103245 Overview

CVE-2026-103245 is a missing signature verification vulnerability in the n8n workflow automation platform. The Webflow Trigger node fails to validate the x-webflow-signature HMAC header on incoming webhook requests. Unauthenticated remote attackers can send forged webhook payloads that invoke workflows and manipulate downstream integrations. The flaw is tracked under [CWE-347: Improper Verification of Cryptographic Signature].

Affected releases include n8n versions before 1.123.80, 2.0.0 before 2.39.6, and 2.40.0 before 2.40.1. Patched builds enforce HMAC validation on Webflow webhook deliveries.

Critical Impact
Unauthenticated attackers can forge Webflow webhook requests to trigger arbitrary n8n workflows, causing unintended record creation, API calls, or data manipulation in connected systems.

Affected Products

n8n versions prior to 1.123.80
n8n versions 2.0.0 through 2.39.5
n8n versions 2.40.0 (fixed in 2.40.1)

Discovery Timeline

2026-10-01 - CVE-2026-103245 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103245

Vulnerability Analysis

n8n is an open-source workflow automation platform that uses trigger nodes to start workflows in response to external events. The Webflow Trigger node registers a webhook endpoint that Webflow calls when events occur in a connected site. Webflow signs each delivery with an HMAC and places it in the x-webflow-signature header so receivers can confirm authenticity.

In the affected versions, the Webflow Trigger webhook handler does not verify this signature. Any client that can reach the n8n webhook URL can post an arbitrary JSON body and have the workflow execute as if Webflow sent it. Because triggers often chain into integrations such as CRMs, databases, and outbound APIs, a forged event becomes an authenticated action downstream.

Root Cause

The root cause is a missing HMAC comparison step in the Webflow Trigger node's request handler. The handler accepts and forwards the request payload to the workflow engine without recomputing the expected signature with the shared secret and comparing it to the x-webflow-signature header value.

Attack Vector

Exploitation requires network access to the n8n webhook endpoint and knowledge or discovery of the trigger path. An attacker crafts an HTTP POST request mimicking the Webflow event schema and sends it to the exposed webhook URL. No credentials, user interaction, or signature material are required. The receiving workflow processes the payload and performs downstream actions chosen by the workflow author, operating on attacker-controlled data.

No verified public exploit code is available at the time of writing. See the GitHub Security Advisory GHSA-hwv9-jhc7-f7c4 and the VulnCheck Advisory for n8n for additional technical context.

Detection Methods for CVE-2026-103245

Indicators of Compromise

Inbound POST requests to Webflow Trigger webhook paths that lack an x-webflow-signature header or contain a signature that does not match the expected HMAC.
Workflow executions originating from Webflow Trigger nodes whose source IP addresses do not resolve to Webflow infrastructure.
Downstream record creation, outbound API calls, or data writes that correlate with unexpected Webflow-triggered workflow runs.

Detection Strategies

Review n8n execution logs for Webflow Trigger invocations and correlate them with legitimate Webflow site activity for the same timeframe.
Inspect reverse proxy or load balancer logs in front of n8n for repeated or malformed requests to /webhook/ paths tied to Webflow triggers.
Validate inventory of exposed n8n instances and confirm that affected versions are enumerated through package manifests or container image tags.

Monitoring Recommendations

Alert on Webflow Trigger executions outside expected business hours or at anomalous frequencies.
Monitor outbound API traffic from n8n for spikes in record creation or write operations that follow webhook events.
Enable audit logging for workflow modifications so unauthorized trigger changes are visible for review.

How to Mitigate CVE-2026-103245

Immediate Actions Required

Upgrade n8n to 1.123.80, 2.39.6, 2.40.1, or later depending on the release branch in use.
Audit all Webflow Trigger workflows and review recent executions for unexpected invocations prior to the upgrade.
Restrict network exposure of the n8n webhook endpoint to known Webflow IP ranges where feasible.

Patch Information

The n8n maintainers released fixed builds in 1.123.80, 2.39.6, and 2.40.1. These versions implement HMAC verification against the x-webflow-signature header before dispatching the payload to the workflow engine. Patch details are tracked in GitHub Security Advisory GHSA-hwv9-jhc7-f7c4.

Workarounds

Place affected n8n instances behind an authenticating reverse proxy that validates Webflow signatures or source IPs until the upgrade is applied.
Temporarily disable Webflow Trigger workflows that perform sensitive downstream actions such as writes to production systems.
Rotate any Webflow webhook secrets after upgrading to invalidate credentials that may have been exposed through forged traffic.

bash

# Upgrade n8n via npm to a patched release
npm install -g n8n@1.123.80

# Or pull a patched Docker image
docker pull n8nio/n8n:1.123.80