CVE-2026-56360 n8n CVE debrief

Who should care

Users of n8n versions before 1.123.18 and 2.6.2 who utilize the ZendeskTrigger node with Zendesk webhooks should verify their configurations and update to a patched version to prevent potential malicious data injection. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact on their environments and take necessary actions.

Technical summary

n8n, a workflow automation tool, is vulnerable to webhook forgery in its ZendeskTrigger node. The issue arises from the failure to verify HMAC-SHA256 signatures on incoming Zendesk webhooks. This oversight allows attackers who know the webhook URL to send unsigned POST requests, potentially triggering workflows with arbitrary malicious data. The vulnerability affects n8n versions before 1.123.18 and 2.6.2. To mitigate this risk, users should update to a patched version and verify their configurations.

Defensive priority

Medium priority should be given to updating n8n instances to versions 1.123.18 or 2.6.2, or later, to mitigate the risk of webhook forgery and potential data injection attacks. Additionally, defenders should review the affected scope, severity, and vendor guidance to assess the impact on their environments.

Recommended defensive actions

• Update n8n to version 1.123.18 or 2.6.2, or later.
• Verify and validate all webhook URLs and configurations.
• Implement additional monitoring for suspicious workflow triggers.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD details indicate that n8n versions before 1.123.18 and 2.6.2 are vulnerable. Users should consult the official advisories and documentation for detailed mitigation steps. It is crucial to verify the configurations of the ZendeskTrigger node and ensure that HMAC-SHA256 signatures are properly validated to prevent potential malicious data injection. Additionally, defenders should review the affected scope, severity, and vendor guidance to assess the impact on their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.