{"data":{"id":"8a70f574-894c-4a5d-beae-31c43ed89b6d","title":"GHSA-5m98-cgcr-xx3q: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open","summary":"The n8n GitHub Trigger node generated a signing secret when registering a webhook but discarded it when GitHub returned a 422 because a hook for the URL already existed. Signature verification on X-Hub-Signature-256 then accepted deliveries to that workflow's webhook URL from anyone. The fix re-fetches the existing hook by its stored id, re-applies the signing secret, and makes verification fail closed when no secret is stored.","solution":"Fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2; upgrade to one of these or later. If upgrading is not immediately possible, temporary workarounds are: deactivate and reactivate GitHub Trigger workflows after deleting the remote GitHub hook so a new secret is generated; restrict network access to the n8n webhook endpoint to GitHub's published IP ranges; and audit GitHub Trigger static data for entries with a webhookId but no webhookSecret, treating those workflows as unprotected until reactivated. The source states these workarounds do not fully remediate the risk and are short-term measures only.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-5m98-cgcr-xx3q","publishedAt":"2026-09-10T21:06:37.000Z","cveId":"CVE-2026-86080","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0, < 2.37.7 (fixed: 2.37.7)","n8n@>= 2.38.0, < 2.38.2 (fixed: 2.38.2)","n8n@< 1.123.76 (fixed: 1.123.76)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00259,"epssCheckedAt":"2026-11-04T12:08:33.950Z","kevDateAdded":null,"advisoryAliases":["GHSA-5m98-cgcr-xx3q"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-10T21:06:37.000Z","fixReleasedAt":"2026-09-02T07:25:50.542Z","daysToFix":-8,"fixCheckedAt":"2026-10-29T21:30:46.279Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"1.123.76","matchedVersion":"1.123.76","fixReleasedAt":"2026-09-02T07:25:50.542Z","daysToFix":-8,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:30:46.134Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.38.2","matchedVersion":"2.38.2","fixReleasedAt":"2026-09-02T07:38:30.231Z","daysToFix":-8,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:30:46.134Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.37.7","matchedVersion":"2.37.7","fixReleasedAt":"2026-09-02T08:04:03.094Z","daysToFix":-8,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:30:46.134Z"}]}}