The workflow automation platform n8n has a significant security vulnerability that could allow unauthorized parties to manipulate data within connected services. This flaw, identified as CVE-2026-56360, specifically impacts the ZendeskTrigger node and is rated as a Medium severity risk. Essentially, this means that n8n’s integration with Zendesk webhooks fails to perform a crucial security check, leaving it open to attack. An attacker, simply by knowing a workflow’s webhook URL, could bypass security measures and inject their own malicious data, potentially leading to unintended workflow executions or data integrity issues.
CVE Details
- Product: n8n (specifically the ZendeskTrigger node)
- Published: July 8, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
This vulnerability affects various installations of n8n that utilize the ZendeskTrigger node. Specifically, any n8n version prior to 1.123.18, and versions ranging from 2.0.0 up to, but not including, 2.6.2 are susceptible. If your n8n environment falls within these version ranges and uses the ZendeskTrigger node, your system is at risk.
Current Status
The n8n development team has acknowledged this vulnerability, and it has been thoroughly analyzed. Important patches addressing this specific flaw have already been developed and released, indicating a clear path to remediation for affected users.
Severity Level
Rated as Medium severity, this vulnerability presents a notable risk to n8n users. The core issue lies in the ZendeskTrigger node’s failure to verify HMAC-SHA256 signatures on incoming webhooks from Zendesk. This means that if an attacker discovers the unique webhook URL for a workflow, they can craft and send unsigned POST requests containing arbitrary, potentially malicious, data. The n8n system would then process this fake data as if it were legitimate, potentially leading to incorrect operations, data modification, or even triggering unintended automated tasks within your n8n workflows and connected services.
Possible Solutions
To fully address and remediate CVE-2026-56360, the most critical step is to upgrade your n8n installation. The security flaw has been fixed in versions 1.123.18 and 2.6.2. Therefore, upgrading your n8n instance to either of these versions or any subsequent release will ensure that the ZendeskTrigger node properly verifies webhook signatures, preventing unauthorized data injection.
For situations where an immediate software upgrade is not possible, the following temporary workarounds can help reduce the exposure:
- Limit Permissions: Restrict the ability to create and modify workflows to only a select group of highly trusted administrators within your organization. This reduces the attack surface by controlling who can potentially set up vulnerable trigger nodes.
- Network Access Restrictions: Implement firewall rules or other network security controls to limit incoming traffic to your n8n webhook endpoint. Specifically, configure these controls to accept connections only from known and verified IP ranges used by Zendesk. This adds a layer of defense by blocking requests from unknown sources.
It is crucial to understand that these workarounds are temporary measures and do not provide a complete fix. They should only be used as short-term mitigations while you prepare for and execute the recommended software upgrade to a patched version of n8n.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq
https://www.vulncheck.com/advisories/n8n-webhook-forgery-via-unsigned-post-requests-in-zendesktrigger
