CVE-2026-86080 Overview
CVE-2026-86080 affects n8n, an open source workflow automation platform. The vulnerability resides in the GitHub Trigger node, which generates a webhook secret during registration but discards it when GitHub returns an HTTP 422 response and the node reuses an existing webhook. Workflow static data then retains the webhookId without the corresponding webhookSecret. As a result, X-Hub-Signature-256 verification accepts inbound deliveries without a stored secret, enabling unsigned or forged payloads to trigger workflows. The issue is tracked under [CWE-347: Improper Verification of Cryptographic Signature]. Fixed releases are 1.123.76, 2.37.7, and 2.38.2.
Critical Impact
Attackers can deliver spoofed GitHub webhook events to affected n8n instances, triggering automation workflows without possessing a valid HMAC-SHA256 signature.
Affected Products
- n8n versions prior to 1.123.76
- n8n versions prior to 2.37.7
- n8n versions prior to 2.38.2
Discovery Timeline
- 2026-09-08 - CVE-2026-86080 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86080
Vulnerability Analysis
The defect lives in packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts. When the GitHub Trigger node registers a webhook, it generates a fresh secret and sends the create request to the GitHub API. GitHub returns HTTP 422 when a matching webhook already exists on the repository. In that reuse path, the node keeps the existing webhookId but drops the newly generated webhookSecret from persistent storage.
The verification routine treats the absence of a stored secret as a signal to skip signature validation. Inbound webhook requests bearing arbitrary or missing X-Hub-Signature-256 headers are then accepted as authentic. Any actor able to reach the n8n webhook endpoint over the network can invoke workflows that trust GitHub event payloads.
Root Cause
The root cause is a state inconsistency between webhook registration and secret persistence. The 422 reuse branch fails to fetch or regenerate a matching secret and does not fail closed. Combined with permissive verification logic that accepts deliveries when no secret is on record, this produces an authentication bypass against the HMAC-SHA256 signature scheme.
Attack Vector
Exploitation requires network access to the n8n webhook URL and knowledge of the workflow path. Once the reuse condition has occurred, an attacker sends crafted HTTP POST requests emulating GitHub event payloads. Because no shared secret is enforced, the trigger fires and downstream nodes execute with attacker-controlled input. Impact depends on workflow logic, which may include internal API calls, code deployment, or data mutation.
See the GitHub Security Advisory GHSA-5m98-cgcr-xx3q for the maintainer analysis and remediation notes.
Detection Methods for CVE-2026-86080
Indicators of Compromise
- Inbound POST requests to /webhook/* endpoints tied to GitHub Trigger nodes lacking a valid X-Hub-Signature-256 header.
- Workflow static data entries containing a webhookId field with no corresponding webhookSecret value.
- Unexpected workflow executions triggered outside of legitimate GitHub push, pull request, or release events.
Detection Strategies
- Audit n8n workflow static data for GitHub Trigger nodes and flag any entry where webhookSecret is null or missing.
- Review reverse proxy or ingress logs for GitHub webhook deliveries whose source IP falls outside GitHub's published address ranges.
- Correlate n8n execution logs with GitHub audit logs to identify trigger events that have no matching delivery record on the GitHub side.
Monitoring Recommendations
- Enable verbose logging on the n8n webhook receiver and alert on requests missing or failing signature verification.
- Track HTTP 422 responses from the GitHub API in n8n operational logs; these indicate the reuse path was taken.
- Monitor for anomalous workflow execution frequency, especially outside business hours or from repositories with low change volume.
How to Mitigate CVE-2026-86080
Immediate Actions Required
- Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2 depending on the release track in use.
- Enumerate all GitHub Trigger nodes and delete or recreate them so a fresh webhook and secret pair is registered.
- Rotate any credentials or tokens that could have been exposed through workflows triggered by unauthenticated deliveries.
Patch Information
The maintainers fixed the flaw in n8n@1.123.76, n8n@2.37.7, and n8n@2.38.2. The patched logic ensures that when GitHub returns HTTP 422, the node retrieves or resets the webhook secret before persisting workflow data, and rejects deliveries lacking a valid X-Hub-Signature-256 signature.
Workarounds
- Restrict network access to n8n webhook endpoints so only GitHub's published IP ranges can reach /webhook/* paths.
- Place n8n behind a reverse proxy that validates X-Hub-Signature-256 using a shared secret before forwarding requests.
- Disable or remove GitHub Trigger nodes in workflows that perform sensitive operations until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
