CVE-2026-56360: N8n N8n Auth Bypass Vulnerability

CVE-2026-56360 Overview

CVE-2026-56360 is an authentication bypass vulnerability in n8n, an open-source workflow automation platform. The flaw affects the ZendeskTrigger node, which fails to verify HMAC-SHA256 signatures on incoming Zendesk webhook requests. Attackers who know or guess a webhook URL can send unsigned POST requests to trigger workflows with attacker-controlled data. This weakness is categorized as [CWE-290] Authentication Bypass by Spoofing. The vulnerability affects n8n versions before 1.123.18 and before 2.6.2.

Critical Impact
Unauthenticated remote attackers can forge Zendesk webhook events to trigger arbitrary n8n workflows, potentially injecting malicious data into downstream automation pipelines.

Affected Products

n8n versions prior to 1.123.18
n8n versions prior to 2.6.2
Deployments using the ZendeskTrigger node on Node.js

Discovery Timeline

2026-07-08 - CVE-2026-56360 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56360

Vulnerability Analysis

The vulnerability resides in the ZendeskTrigger node inside n8n. Zendesk webhooks are designed to include an HMAC-SHA256 signature header that receivers must verify against a shared secret. This signature ensures the request originated from Zendesk and has not been tampered with in transit.

The affected n8n versions accept the webhook payload without performing this signature check. Any HTTP client capable of sending a POST request to the webhook URL can invoke the associated workflow. The Zendesk trust boundary is effectively removed from the automation pipeline.

The attack requires network reachability to the n8n instance and knowledge of the webhook path. Webhook URLs contain randomized identifiers, but they can be leaked through logs, browser history, misconfigured proxies, or shared workflow exports.

Root Cause

The root cause is a missing cryptographic verification step in the trigger node handler. The code path that processes inbound POST requests to the Zendesk webhook endpoint does not compute the expected HMAC-SHA256 digest of the request body and compare it against the X-Zendesk-Webhook-Signature header. Requests are dispatched to the workflow engine regardless of signature validity or absence.

Attack Vector

An attacker sends a crafted POST request directly to the n8n Zendesk webhook endpoint with an arbitrary JSON body. The workflow starts execution with the attacker's payload as if it were a legitimate Zendesk event. Downstream steps that consume the payload — such as ticket enrichment, database writes, outbound API calls, or notification actions — process the forged data. Impact depends on the workflow logic connected to the trigger.

See the VulnCheck Security Advisory for additional technical context.

Detection Methods for CVE-2026-56360

Indicators of Compromise

Inbound POST requests to /webhook/* Zendesk trigger paths missing the X-Zendesk-Webhook-Signature header.
Requests to Zendesk webhook endpoints originating from IP addresses outside published Zendesk egress ranges.
Unexpected workflow executions in n8n audit logs without a corresponding Zendesk event ID.

Detection Strategies

Enable n8n execution logging and correlate each Zendesk-triggered run with a signed source event.
Inspect reverse-proxy or WAF logs for webhook requests lacking the expected signature header.
Alert when ZendeskTrigger workflows execute with payload fields that do not match Zendesk's documented event schema.

Monitoring Recommendations

Forward n8n webhook access logs and workflow execution logs to a centralized SIEM for retention and analysis.
Baseline normal Zendesk webhook volume and source IPs, then alert on statistical deviations.
Monitor for anomalous outbound activity from workflows connected to ZendeskTrigger, such as unusual database writes or third-party API calls.

How to Mitigate CVE-2026-56360

Immediate Actions Required

Upgrade n8n to version 1.123.18 or 2.6.2 or later.
Audit existing workflows that use the ZendeskTrigger node and review recent executions for forged payloads.
Rotate any secrets, tokens, or credentials that were exposed to workflows downstream of the affected trigger.

Patch Information

The maintainers fixed the issue in n8n 1.123.18 and 2.6.2 by adding HMAC-SHA256 verification to the ZendeskTrigger node. Details are documented in the GitHub Security Advisory GHSA-38c7-23hj-2wgq.

Workarounds

Restrict inbound network access to n8n webhook endpoints so only Zendesk IP ranges can reach them.
Place a reverse proxy or WAF in front of n8n that validates the X-Zendesk-Webhook-Signature header before forwarding requests.
Temporarily disable ZendeskTrigger workflows until the patched version is deployed.

bash

# Example nginx allowlist for Zendesk webhook endpoints (adjust IP ranges to current Zendesk documentation)
location /webhook/ {
    allow 192.161.128.0/19;
    deny all;
    proxy_pass http://n8n_upstream;
}