n8n is a popular open-source platform that helps you automate various workflows. It’s designed to connect different apps and services without needing extensive coding. Recently, a security flaw was discovered in how n8n handles webhooks from GitHub, identified as CVE-2026-86080. This vulnerability could allow an attacker to bypass an important security check, potentially leading to unauthorized actions within your automated workflows.
At its core, the issue stems from the GitHub Trigger feature within n8n. When setting up a GitHub webhook, a secret key is normally generated to verify that incoming messages genuinely originate from GitHub. However, under specific conditions (specifically, when GitHub returns an HTTP 422 error and n8n reuses an existing webhook), this crucial secret was accidentally discarded. This meant that subsequent webhook deliveries could be accepted by n8n without the proper security signature verification (X-Hub-Signature-256), making your workflows vulnerable to spoofed messages.
CVE Details
Product: n8n (open-source workflow automation platform)
Published Date: September 8, 2026
Severity: Medium (CVSS Score 5.3)
Status: Analyzed
Affected Products
This vulnerability impacts versions of n8n that are older than:
- n8n 1.123.76
- n8n 2.37.7
- n8n 2.38.2
If you are running any n8n instance prior to these versions, your system could be at risk.
Current Status
The vulnerability, CVE-2026-86080, has been officially ‘Analyzed’. This means the issue has been thoroughly investigated, understood, and its impact assessed by the n8n team and security researchers.
Severity Level
Rated as ‘Medium’ severity with a CVSS score of 5.3, this vulnerability indicates a moderate risk. While not critical, it’s important for users to address it promptly. A medium severity typically means that exploiting the vulnerability might require specific conditions or could lead to information disclosure or limited impact, rather than full system compromise. In this case, it primarily affects the integrity of incoming webhook data from GitHub.
Possible Solutions
The good news is that fixes are readily available. To protect your n8n workflows from CVE-2026-86080, it is crucial to update your n8n installation to one of the patched versions as soon as possible:
- Upgrade to n8n 1.123.76 or newer (for the 1.x series)
- Upgrade to n8n 2.37.7 or newer (for the 2.x series)
- Upgrade to n8n 2.38.2 or newer (for the 2.x series)
These updates contain the necessary corrections to ensure that GitHub webhook secrets are correctly handled and verified, restoring the intended security measures. Always refer to the official n8n documentation for detailed upgrade instructions relevant to your specific deployment method.
References
https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
https://github.com/n8n-io/n8n/security/advisories/GHSA-5m98-cgcr-xx3q
