Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-126382— n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset

Quick assessment

Affected

n8n-io n8n

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

n8n 在 2.38.0 之前以及 3.x 系列中 3.0.1 之前的版本存在一个 Asana Trigger（Asana 触发器）中的身份验证缺失漏洞。该触发器会接受任何携带请求头的请求所提交的新 Webhook 验证密钥。未认证的攻击者若知晓 Webhook URL，即可替换该密钥，发送伪造的 Asana 事件以通过签名验证，并使用攻击者控制的数据触发工作流，同时导致合法的交付请求被拒绝。

CVSS 5.4 · Medium EPSS 0.30% · P23 Updated Nov 15, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

Vendor	Product	Version Range	Status
n8n-io	n8n	`< 2.38.0`	affected
		`2.38.0`	unaffected
		`3.0.0< 3.0.1`	affected
		`3.0.1`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset

Source: CVE Program / CVE List V5

Vulnerability Description

n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accepts a new webhook verification secret from any request carrying an X-Hook-Secret header. Unauthenticated attackers who know the webhook URL can replace the secret, send forged Asana events that pass signature verification, and trigger workflows with attacker-controlled data while genuine deliveries are rejected.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
n8n-io	n8n	0 ~ 2.38.0	-
n8n-io	n8n	3.0.0 ~ 3.0.1	-

II. Public POCs for CVE-2026-126382

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126382

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-126382 (2)

Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret · Advisory · n8n-io/n8n · GitHub vendor-advisory
n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126382

Same Patch Batch · n8n-io · 2026-11-13 · 11 CVEs total

CVE-2026-126383	8.2 HIGH	n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key
CVE-2026-126385	7.7 HIGH	n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback
CVE-2026-126384	7.5 HIGH	n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node
CVE-2026-126391	7.5 HIGH	n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape
CVE-2026-126381	6.3 MEDIUM	n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key
CVE-2026-126389	5.4 MEDIUM	n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat
CVE-2026-126387	5.3 MEDIUM	n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool
CVE-2026-126386	4.7 MEDIUM	n8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client Registration
CVE-2026-126388	3.7 LOW	n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes
CVE-2026-126390	3.7 LOW	n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download

IV. Related Vulnerabilities

Same product: n8n

Same vendor: n8n-io

Same weakness: CWE-306