GHSA-5m98-cgcr-xx3q: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
Summary
A bug in n8n's GitHub Trigger feature caused it to skip storing a security secret when GitHub rejected webhook registration with a 422 error (webhook already exists). This meant incoming webhook deliveries were accepted without signature verification (checking that messages came from the real GitHub), allowing anyone to trigger workflows. The issue has been patched in versions 1.123.76, 2.37.7, and 2.38.2.
Solution / Mitigation
Upgrade to n8n versions 1.123.76, 2.37.7, or 2.38.2 or later. If immediate upgrade is not possible, temporary workarounds include: (1) deactivate and reactivate GitHub Trigger workflows after deleting the remote GitHub webhook to force fresh registration with a new secret, (2) restrict network access to the n8n webhook endpoint to GitHub's published IP ranges only, or (3) audit GitHub Trigger workflow data for entries with a `webhookId` but no `webhookSecret` and treat those as unprotected until reactivated. The source notes these workarounds do not fully resolve the risk and should only be temporary measures.
Vulnerability Details
EPSS: 0.2%
Yes
September 10, 2026
Classification
Taxonomy References
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://github.com/advisories/GHSA-5m98-cgcr-xx3q
First tracked: September 10, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 85%