VULNERABILITY INTELLIGENCE

CVE-2026-56360

CVSS score6.3 MEDIUM
EPSS probability0.31%
CISA KEVNot currently listed
Published2026-07-08
Last modified2026-10-25
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Description

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.

Weakness classification

  • CWE-290: Authentication Bypass by Spoofing

Primary references