{"data":{"id":"8a70f574-894c-4a5d-beae-31c43ed89b6d","title":"GHSA-5m98-cgcr-xx3q: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open","summary":"A bug in n8n's GitHub Trigger feature caused it to skip storing a security secret when GitHub rejected webhook registration with a 422 error (webhook already exists). This meant incoming webhook deliveries were accepted without signature verification (checking that messages came from the real GitHub), allowing anyone to trigger workflows. The issue has been patched in versions 1.123.76, 2.37.7, and 2.38.2.","solution":"Upgrade to n8n versions 1.123.76, 2.37.7, or 2.38.2 or later. If immediate upgrade is not possible, temporary workarounds include: (1) deactivate and reactivate GitHub Trigger workflows after deleting the remote GitHub webhook to force fresh registration with a new secret, (2) restrict network access to the n8n webhook endpoint to GitHub's published IP ranges only, or (3) audit GitHub Trigger workflow data for entries with a `webhookId` but no `webhookSecret` and treat those as unprotected until reactivated. The source notes these workarounds do not fully resolve the risk and should only be temporary measures.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-5m98-cgcr-xx3q","publishedAt":"2026-09-10T21:06:37.000Z","cveId":"CVE-2026-86080","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0, < 2.37.7 (fixed: 2.37.7)","n8n@>= 2.38.0, < 2.38.2 (fixed: 2.38.2)","n8n@< 1.123.76 (fixed: 1.123.76)"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.002,"patchAvailable":true,"disclosureDate":"2026-09-10T21:06:37.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}