UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126382

n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset

Severity
Medium 6.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.38.0, 3.0.1
Weakness
Missing authentication (CWE-306)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Change some data · Slow it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:N
Sources
CVE Program

Description

n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accepts a new webhook verification secret from any request carrying an X-Hook-Secret header. Unauthenticated attackers who know the webhook URL can replace the secret, send forged Asana events that pass signature verification, and trigger workflows with attacker-controlled data while genuine deliveries are rejected.

From the CVE Program.

Affected software

SoftwareAffected versions
n8nServers and applications · cna:n8n-io|n8n
  • Every version before 2.38.0
  • From 3.0.0 before 3.0.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126382