Live › vulnerability › CVE-2026-118679
Go to dashboardn8n's Slack Trigger webhook skips signature checks when no signing secret is set, so anyone who knows the webhook URL can make it fetch an attacker-chosen file. The request sends the Slack workspace access token to the attacker's host, which exposes that token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Teams running self-hosted n8n with a Slack Trigger node whose webhook is reachable from the internet and whose signing secret is not set. Instances without a Slack Trigger, or with a signing secret configured, are not described as exposed by the sources. Managed n8n hosting is handled by the vendor, so those teams should confirm the vendor has applied the fix.
No product ranges from the sources yet.
n8n --version (or check the n8n image tag) and compare against 1.123.83, 2.41.4 and 2.42.1.1.123.83 on the 1.x line, 2.41.4 on 2.41.x, or 2.42.1 on 2.42.x.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.
This page as .md · .json · in your agent: get_signal("CVE-2026-118679")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.