Answer in brief
CVE-2026-56357 records a Medium severity (CVSS 4.0) security vulnerability in n8n: Webhook Forgery on Github Webhook Trigger. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
Answer in brief
CVE-2026-56357 records a Medium severity (CVSS 4.0) security vulnerability in n8n: Webhook Forgery on Github Webhook Trigger. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
Update n8n to 1.123.15; n8n to 2.5.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-56357 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| n8nnpm | <1.123.15 | 1.123.15 |
| n8nnpm | >=2.0.0,<2.5.0 | 2.5.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-56357 records a Medium severity (CVSS 4.0) security vulnerability in n8n: Webhook Forgery on Github Webhook Trigger. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for n8n, n8n.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate n8n to 1.123.15; n8n to 2.5.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-56357 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| n8nnpm | <1.123.15 | 1.123.15 |
| n8nnpm | >=2.0.0,<2.5.0 | 2.5.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-56357 records a Medium severity (CVSS 4.0) security vulnerability in n8n: Webhook Forgery on Github Webhook Trigger. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for n8n, n8n.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard## Impact An attacker who knows the webhook URL of a workflow using the GitHub Webhook Trigger node could send unsigned POST requests and trigger the workflow with arbitrary data. The node did not implement the HMAC-SHA256 signature verification that GitHub provides to authenticate webhook deliveries, allowing any party to spoof GitHub webhook events. ## Patches The issue has been fixed in n8n versions 2.5.0 and 1.123.15. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Restrict network access to the n8n webhook endpoint to known GitHub webhook IP ranges. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
## Impact An attacker who knows the webhook URL of a workflow using the GitHub Webhook Trigger node could send unsigned POST requests and trigger the workflow with arbitrary data. The node did not implement the HMAC-SHA256 signature verification that GitHub provides to authenticate webhook deliveries, allowing any party to spoof GitHub webhook events. ## Patches The issue has been fixed in n8n versions 2.5.0 and 1.123.15. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Restrict network access to the n8n webhook endpoint to known GitHub webhook IP ranges. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.