| Package | Affected versions | Patched versions |
|---|---|---|
| n8n | ≥ 2.0.0, < 2.37.7≥ 2.38.0, < 2.38.2< 1.123.76 | 2.37.72.38.21.123.76 |
| n8n | ≥ 2.0.0, < 2.37.7≥ 2.38.0, < 2.38.2< 1.123.76 | 2.37.72.38.21.123.76 |
The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already existed, the node adopted the remote hook but kept only its id and events, discarding the secret it had generated. Deliveries to that workflow's webhook URL were then accepted from anyone. The patch re-fetches the existing hook by its stored id, re-applies the signing secret, and makes verification fail closed when no secret is stored.
The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
webhookId but no webhookSecret, and treat those workflows as unprotected until reactivated successfully.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free