{"action":"Upgrade n8n to 1.123.15 or later.","affected":[{"fixed":"1.123.15","introduced":"0"},{"fixed":"2.5.0","introduced":"2.0.0"}],"component":"n8n","cve_ids":["CVE-2026-56357"],"ecosystem":"npm","epss":0.00314,"exploited":false,"fixed_versions":["1.123.15","2.5.0"],"ghsa_id":"GHSA-mqpr-49jj-32rc","id":"tcs_01M5KG1H2TGRKH8FS3TBASQ3H0","modified_at":"2026-07-18T17:45:20.568532301Z","published_at":"2026-02-26T15:58:34Z","references":["https://osv.dev/vulnerability/GHSA-mqpr-49jj-32rc","https://github.com/n8n-io/n8n/security/advisories/GHSA-mqpr-49jj-32rc","https://nvd.nist.gov/vuln/detail/CVE-2026-56357","https://github.com/n8n-io/n8n/commit/a19347a6bc9a96d5065ac77d25a811e46178c578","https://github.com/n8n-io/n8n/commit/afe322325502f448b33bff1db1575e4447c28a36","https://github.com/n8n-io/n8n","https://www.vulncheck.com/advisories/n8n-webhook-forgery-via-missing-hmac-sha256-signature-verification-in-github-webhook-trigger"],"severity":{"label":"medium","score":4},"sources":[{"source":"osv","source_id":"GHSA-mqpr-49jj-32rc","url":"https://osv.dev/vulnerability/GHSA-mqpr-49jj-32rc"}],"summary":"n8n: Webhook Forgery on Github Webhook Trigger"}