n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
n8n
- Severity
- High, CVSS 7.2
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Record
- CVE-2026-54308
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 25, 2026
Description
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.
Description quoted from the NVD record.
Who is affected
n8n is a tool for connecting different apps and automating tasks between them. This flaw affects n8n versions before 2.25.7 and 2.26.2. It is in two building blocks that start a workflow when a message arrives: the Microsoft Agent 365 trigger and the Stripe trigger. These did not check that incoming messages were genuine. Anyone who knows the web address a trigger listens on could send a fake message without logging in, and your workflow would run using data the attacker chose. This flaw is rated High.
What to do
- Find out who runs n8n for your organization: the person who installed it, or the IT provider or vendor who manages it. That person should handle the steps below.
- If your organization runs n8n itself, have the person who installed it update it to version
2.25.7or2.26.2, or a later release. These versions fix this flaw. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- Ask whoever runs n8n whether any of your workflows use the Microsoft Agent 365 trigger or the Stripe trigger, since those are the parts with this problem.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.