| Component | n8n |
| Severity | high (CVSS 7.5) |
| CVSS vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N |
| Published (NVD) | 2026-10-28 |
| Affected versions | < 1.123.83 >= 2.0.0, < 2.41.4 >= 2.42.0, < 2.42.1 from the CVE Program record written by the CNA that assigned the CVE |
| Fixed in | 1.123.83, 2.41.4, 2.42.1 |
| Weakness | CWE-918 |
| CISA KEV | not listed |
Versions, checked against NVD
NVD's record (status: Deferred) lists no affected versions of n8n for this CVE. The ranges above come from the CVE record written by VulnCheck, the CNA that assigned the CVE.
NVD description
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.
What to do
- Upgrade n8n to the fixed release of the branch you run:
1.123.83,2.41.4or2.42.1, or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-118679
- https://github.com/n8n-io/n8n/security/advisories/GHSA-3c3p-5959-3ghr
- https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-slack-token-exfiltration-via-slack-trigger