n8n has Webhook Forgery on Zendesk Trigger Node
Medium4.0CVE-2026-56360 · Published Feb 26, 2026 · updated Jul 9, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | < 1.123.18 | 1.123.18 |
| >= 2.0.0, < 2.6.2 | 2.6.2 |
Details and references
## Impact An attacker who knows the webhook URL of a workflow using the ZendeskTrigger node could send unsigned POST requests and trigger the workflow with arbitrary data. The node does not verify the HMAC-SHA256 signature that Zendesk attaches to every outbound webhook, allowing any party to inject crafted payloads into the connected workflow. ## Patches The issue has been fixed in n8n versions 2.6.2 and 1.123.18. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Restrict network access to the n8n webhook endpoint to known Zendesk IP ranges. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-290
- Also known as
- CVE-2026-56360
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 25 | n8n Vulnerable to Stored XSS via Various Nodes CVE-2026-27578High5.4fixed in 1.123.22, 2.9.3, 2.10.1 | High5.4 | 1.123.22, 2.9.3, 2.10.1 |
| Feb 25 | n8n: Expression Sandbox Escape Leads to RCE CVE-2026-27577Critical9.9fixed in 1.123.22, 2.9.3, 2.10.1 | Critical9.9 | 1.123.22, 2.9.3, 2.10.1 |
| Feb 25 | n8n has Arbitrary Command Execution via File Write and Git Operations CVE-2026-27498Critical8.5fixed in 1.123.8, 2.2.0 | Critical8.5 | 1.123.8, 2.2.0 |
| Feb 25 | n8n has Potential Remote Code Execution via Merge Node CVE-2026-27497Critical9.9fixed in 1.123.22, 2.9.3, 2.10.1 | Critical9.9 | 1.123.22, 2.9.3, 2.10.1 |
| Feb 25 | n8n has a Sandbox Escape in its JavaScript Task Runner CVE-2026-27495Criticalfixed in 1.123.22, 2.9.3, 2.10.1 | Critical | 1.123.22, 2.9.3, 2.10.1 |
| Feb 25 | n8n has Arbitrary File Read via Python Code Node Sandbox Escape CVE-2026-27494High9.9fixed in 1.123.22, 2.9.3, 2.10.1 | High9.9 | 1.123.22, 2.9.3, 2.10.1 |