CVE-2026-103245 in n8n
Summary
by MITRE • 10/01/2026
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in n8n versions prior to 1.123.80, as well as specific ranges within the v2.x series including those before 2.39.6 and between 2.40.0 and 2.40.1, represents a critical failure in input validation for webhook integrations. Specifically, this flaw resides within the Webflow Trigger node's webhook handler mechanism. The core technical deficiency is the absence of cryptographic verification for the x-webflow-signature header, which utilizes an HMAC (Hash-based Message Authentication Code) to ensure message integrity and authenticity. In a properly secured implementation, any incoming webhook request must be validated against a shared secret key known only to the service provider and n8n. By failing to perform this check, the application accepts requests from any source without confirming their origin or integrity, effectively treating unauthenticated data as trusted input.
This architectural oversight allows for severe operational impacts stemming from unauthorized access and potential remote code execution pathways through workflow manipulation. Unauthenticated attackers can craft malicious HTTP POST requests containing forged payloads that mimic legitimate Webflow webhook events. Because the signature verification is bypassed, these spoofed triggers are processed by n8n as if they were genuine system events. This enables adversaries to initiate workflows arbitrarily, leading to a range of detrimental outcomes depending on the configured automation logic. Common downstream actions triggered by such manipulated webflows include unauthorized data creation in connected databases, execution of arbitrary API calls to external services, or triggering email notifications that could be used for phishing campaigns. The ability to inject attacker-controlled payloads into these automated processes means that sensitive business logic can be subverted, potentially leading to data exfiltration, integrity violations, or denial of service conditions if the triggered workflows are resource-intensive.
From a classification perspective, this vulnerability aligns with CWE-347, which describes Improper Verification of Cryptographic Signature, as it involves the failure to validate digital signatures that guarantee message authenticity and integrity. Furthermore, in the context of the MITRE ATT&CK framework, this flaw facilitates techniques associated with Initial Access via Web Services (T1190) and potentially Command and Control if the workflows are used to establish persistent backdoors or exfiltrate data over allowed channels. The lack of authentication at the webhook endpoint also touches upon CWE-287, Improper Authentication, as the system fails to verify the identity of the sender before processing sensitive automation tasks.
To mitigate this risk, organizations running affected versions of n8n must immediately upgrade to version 1.123.80 or later for the v1 branch, and to version 2.39.6 or higher (excluding the vulnerable 2.40.x range) or specifically version 2.40.1 and above for the v2 branch. These releases contain patches that enforce strict HMAC verification against the configured Webflow secret key before any workflow execution is initiated. For environments where immediate upgrading is not feasible, temporary mitigations include restricting access to the webhook endpoint via network-level controls such as IP whitelisting or firewall rules, although this approach does not fully address the risk if legitimate users require dynamic access. Additionally, implementing strict rate limiting and monitoring for anomalous workflow execution patterns can help detect exploitation attempts in real-time while longer-term remediation strategies are deployed.