CyberRota Analysis
AI-Generatedn8n versions prior to 1.123.18 and 2.6.2 are vulnerable due to inadequate verification of HMAC-SHA256 signatures on Zendesk webhooks, allowing attackers with knowledge of the webhook URL to send unsigned POST requests. This could lead to the execution of arbitrary workflows with malicious data, potentially compromising the integrity of automated processes. Organizations using n8n for workflow automation, particularly those integrating with Zendesk, should prioritize addressing this vulnerability to mitigate risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.
Related CVEs
Other vulnerabilities affecting the same vendor(s)