CVE-2026-126382 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
The n8n workflow automation tool's Asana Trigger node accepts a new webhook verification secret from any request carrying an X-Hook-Secret header, without authentication. An unauthenticated attacker who knows the webhook URL can replace the secret, forge Asana events that pass verification, and start workflows with attacker-controlled data.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run self-hosted n8n with workflows using the Asana Trigger node are exposed, because the webhook URL is reachable from the internet. Instances without Asana Trigger workflows, or on fixed versions, can skip it.
Not affected if fixed-version, no-asana-trigger
Who cares asana, n8n, self-hosted
n8n --version or the instance's settings page; affected versions are before 2.38.0 and 3.x before 3.0.1.2.38.0: move to 2.38.03.x before 3.0.1: move to n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accepts a new webhook verification secret from any request carrying an X-Hook-Secret header. Unauthenticated attackers who know the webhook URL can replace the secret, send forged Asana events that pass signature verification, and trigger workflows with attacker-controlled data while genuine deliveries are rejected.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
3.0.1