n8n: N8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk…
n8n
- Severity
- Medium, CVSS 4.0
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- Record
- CVE-2026-56360
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 8, 2026
- Source last modified
- October 25, 2026
Description
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.
Description quoted from the NVD record.