n8n-io n8n up to 2.2.1 Webhook Endpoint authentication spoofing

Summaryinfo

A vulnerability described as critical has been identified in n8n-io n8n up to 2.2.1. Affected by this issue is some unknown functionality of the component Webhook Endpoint. The manipulation results in authentication spoofing. This vulnerability is cataloged as CVE-2026-21894. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in n8n-io n8n up to 2.2.1. It has been classified as critical. Affected is an unknown code block of the component Webhook Endpoint. The manipulation with an unknown input leads to a authentication spoofing vulnerability. CWE is classifying the issue as CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stripe webhook signing secret when registering the webhook endpoint, but incoming webhook requests were not verified against this secret. As a result, any HTTP client that knows the webhook URL could send a POST request containing a matching event type, causing the workflow to execute as if a legitimate Stripe event had been received. This issue affects n8n users who have active workflows using the Stripe Trigger node. An attacker could potentially fake payment or subscription events and influence downstream workflow behavior. The practical risk is reduced by the fact that the webhook URL contains a high-entropy UUID; however, authenticated n8n users with access to the workflow can view this webhook ID. This issue has been patched in version 2.2.2. A temporary workaround for this issue involves users deactivating affected workflows or restricting access to workflows containing Stripe Trigger nodes to trusted users only.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-21894 since 01/05/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.2.2 eliminates this vulnerability. Applying the patch a61a5991093c41863506888336e808ac1eff8d59 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0040). Once again VulDB remains the best source for vulnerability data.

Affected

• n8n n8n

Productinfo

Vendor

• n8n-io

Name

• n8n

Version

• 2.2.0
• 2.2.1

License

• open-source

Website

• Product: https://github.com/n8n-io/n8n/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion