CVE-2026-56357: N8n GitHub Webhook CSRF Vulnerability

CVE-2026-56357 Overview

CVE-2026-56357 is a webhook forgery vulnerability in n8n, a workflow automation platform. Versions of n8n before 1.123.15 and 2.5.0 ship a GitHub Webhook Trigger node that does not verify HMAC-SHA256 signatures on incoming requests. Attackers who know or guess the webhook URL can send unsigned POST requests to trigger workflows with arbitrary payloads. This allows them to spoof GitHub events and inject attacker-controlled data into automation pipelines. The weakness is classified under [CWE-290] (Authentication Bypass by Spoofing) and affects both community and enterprise editions distributed via Node.js.

Critical Impact
Unauthenticated attackers can forge GitHub webhook events to trigger n8n workflows with arbitrary data, bypassing the integrity controls expected from GitHub's signed webhook delivery.

Affected Products

n8n community edition versions before 1.123.15
n8n enterprise edition versions before 2.5.0
GitHub Webhook Trigger node in n8n (Node.js)

Discovery Timeline

2026-06-22 - CVE-2026-56357 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56357

Vulnerability Analysis

The vulnerability resides in the GitHub Webhook Trigger node inside n8n. GitHub signs every webhook delivery with an HMAC-SHA256 digest sent in the X-Hub-Signature-256 header. Receivers are expected to recompute that digest using a shared secret and reject requests where the value does not match. The n8n trigger node skips this verification step entirely. Any HTTP client capable of reaching the webhook URL can therefore submit a crafted POST request that n8n will treat as an authentic GitHub event. Because n8n workflows often act on webhook payloads, the forged input can drive downstream actions such as repository operations, notifications, deployments, or data writes.

Root Cause

The root cause is missing signature validation logic in the GitHub Webhook Trigger node. The node accepts the webhook secret as configuration but never compares the expected HMAC-SHA256 digest against the X-Hub-Signature-256 header on incoming requests. This is a classic spoofing-by-design flaw mapped to [CWE-290], where the application trusts the request origin without cryptographic proof.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker needs only the webhook URL, which is often discoverable through reconnaissance of public repositories, leaked configuration files, or predictable URL patterns. The attacker sends a POST request with a JSON body mimicking a GitHub event (for example push, pull_request, or issues) and omits or fabricates the X-Hub-Signature-256 header. n8n executes the associated workflow using the attacker's payload as input. See the VulnCheck Security Advisory for technical details.

Detection Methods for CVE-2026-56357

Indicators of Compromise

POST requests to n8n GitHub webhook endpoints that lack an X-Hub-Signature-256 header or contain an invalid signature value.
Workflow executions triggered by source IP addresses outside GitHub's published webhook IP ranges.
Unexpected workflow runs whose payloads reference repositories, branches, or commits that do not exist in the linked GitHub organization.

Detection Strategies

Inspect n8n execution logs for GitHub Webhook Trigger runs and correlate the source IP with GitHub's documented webhook ranges via the meta/hooks API.
Deploy a reverse proxy or WAF rule in front of n8n that logs requests to /webhook/* paths missing the X-Hub-Signature-256 header.
Hunt for anomalous workflow activity such as repeated triggers from a single non-GitHub IP or payloads with malformed event metadata.

Monitoring Recommendations

Enable verbose logging on n8n webhook endpoints and forward logs to a centralized SIEM for retention and correlation.
Alert on workflow executions that originate from IPs outside GitHub's ASN, especially for triggers tied to production-impacting actions.
Track the n8n version deployed across your environment and alert when instances fall behind 1.123.15 (community) or 2.5.0 (enterprise).

How to Mitigate CVE-2026-56357

Immediate Actions Required

Upgrade n8n community edition to 1.123.15 or later, and enterprise edition to 2.5.0 or later.
Rotate any GitHub webhook secrets associated with affected workflows in case they were exposed during the unverified window.
Audit recent workflow executions triggered by the GitHub Webhook Trigger node for unauthorized or unexpected activity.

Patch Information

The maintainers released fixes in n8n 1.123.15 and 2.5.0, which implement HMAC-SHA256 verification on the GitHub Webhook Trigger node. Refer to the GitHub Security Advisory GHSA-mqpr-49jj-32rc for the full patch description and upgrade guidance.

Workarounds

Place n8n behind a reverse proxy that validates the X-Hub-Signature-256 header against the configured webhook secret before forwarding requests.
Restrict inbound access to n8n webhook endpoints to GitHub's published webhook IP ranges using firewall or cloud security group rules.
Disable or remove GitHub Webhook Trigger nodes from production workflows until upgrades are completed.

bash

# Example nginx snippet restricting n8n webhook endpoints to GitHub IP ranges
# Replace the allow entries with the current ranges from https://api.github.com/meta
location /webhook/ {
    allow 140.82.112.0/20;
    allow 143.55.64.0/20;
    allow 192.30.252.0/22;
    deny all;
    proxy_pass http://n8n_upstream;
}