{"id":"CVE-2026-126382","kind":"vulnerability","aliases":["CVE-2026-126382"],"related":[],"title":"n8n: Asana Trigger accepts forged webhook secrets from any request","description":"n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accepts a new webhook verification secret from any request carrying an X-Hook-Secret header. Unauthenticated attackers who know the webhook URL can replace the secret, send forged Asana events that pass signature verification, and trigger workflows with attacker-controlled data while genuine deliveries are rejected.","summary":"The n8n workflow automation tool's Asana Trigger node accepts a new webhook verification secret from any request carrying an X-Hook-Secret header, without authentication. An unauthenticated attacker who knows the webhook URL can replace the secret, forge Asana events that pass verification, and start workflows with attacker-controlled data.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","asana","n8n","self-hosted"],"not_affected_if":["fixed-version","no-asana-trigger"],"how_to_check":"- Check the n8n version with `n8n --version` or the instance's settings page; affected versions are before `2.38.0` and `3.x` before `3.0.1`.\n- Check whether any workflow uses the Asana Trigger node.","fix":"- n8n before `2.38.0`: move to `2.38.0`\n- n8n `3.x` before `3.0.1`: move to `3.0.1`","status":"open","published_at":"2026-11-13T10:17:41+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","triaged_at":"2026-11-13T10:55:23+00:00","updated_at":"2026-11-13T10:55:23+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:55:23Z","model":"claude-haiku-5-5","output":{"fix":"- n8n before `2.38.0`: move to `2.38.0`\n- n8n `3.x` before `3.0.1`: move to `3.0.1`","reach":"internet","title":"n8n: Asana Trigger accepts forged webhook secrets from any request","impact":"medium","summary":"The n8n workflow automation tool's Asana Trigger node accepts a new webhook verification secret from any request carrying an X-Hook-Secret header, without authentication. An unauthenticated attacker who knows the webhook URL can replace the secret, forge Asana events that pass verification, and start workflows with attacker-controlled data.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","asana"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker starts workflows with forged data and blocks genuine Asana events","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the instance's settings page; affected versions are before `2.38.0` and `3.x` before `3.0.1`.\n- Check whether any workflow uses the Asana Trigger node.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-asana-trigger","fixed-version"],"who_is_affected":"Teams that run self-hosted n8n with workflows using the Asana Trigger node are exposed, because the webhook URL is reachable from the internet. Instances without Asana Trigger workflows, or on fixed versions, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4651,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126382':13A,16A '-2026':12A,15A '2.38.0':80C '3':82C '3.0.1':85C 'accept':4A,34B,96C 'ai':18B 'ai-tool':17B 'asana':2A,20B,31B,65B,93C,125C 'attack':54B,75B,113C,136C 'attacker-control':74B,135C 'authent':51B,89C 'autom':28B 'carri':43B,105C 'contain':86C 'control':76B,137C 'cve':11A,14A 'data':77B,138C 'deliveri':141C 'event':66B,126C 'forg':5A,64B,124C 'genuin':140C 'header':49B,111C 'hook':47B,109C 'host':24B 'know':56B,115C 'miss':88C 'n8n':1A,21B,26B,78C 'new':36B,98C 'node':33B 'pass':68B,128C 'reject':143C 'replac':61B,120C 'request':10A,42B,104C 'secret':7A,39B,48B,63B,101C,110C,122C 'self':23B 'self-host':22B 'send':123C 'signatur':129C 'start':71B 'tool':19B,29B 'trigger':3A,32B,94C,132C 'unauthent':53B,112C 'url':59B,118C 'verif':38B,69B,100C,130C 'vulner':90C 'webhook':6A,37B,58B,99C,117C 'without':50B 'workflow':27B,72B,133C 'x':46B,83C,108C 'x-hook-secret':45B,107C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted n8n with workflows using the Asana Trigger node are exposed, because the webhook URL is reachable from the internet. Instances without Asana Trigger workflows, or on fixed versions, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","asana","medium","n8n","selfhosted"],"campaign_type":null,"search_a":"'-126382':13A,16A '-2026':12A,15A 'accept':4A 'asana':2A 'cve':11A,14A 'forg':5A 'n8n':1A 'request':10A 'secret':7A 'trigger':3A 'webhook':6A","search_b":"'accept':34B 'ai':18B 'ai-tool':17B 'asana':20B,31B,65B 'attack':54B,75B 'attacker-control':74B 'authent':51B 'autom':28B 'carri':43B 'control':76B 'data':77B 'event':66B 'forg':64B 'header':49B 'hook':47B 'host':24B 'know':56B 'n8n':21B,26B 'new':36B 'node':33B 'pass':68B 'replac':61B 'request':42B 'secret':39B,48B,63B 'self':23B 'self-host':22B 'start':71B 'tool':19B,29B 'trigger':32B 'unauthent':53B 'url':59B 'verif':38B,69B 'webhook':37B,58B 'without':50B 'workflow':27B,72B 'x':46B 'x-hook-secret':45B","search_c":"'2.38.0':80C '3':82C '3.0.1':85C 'accept':96C 'asana':93C,125C 'attack':113C,136C 'attacker-control':135C 'authent':89C 'carri':105C 'contain':86C 'control':137C 'data':138C 'deliveri':141C 'event':126C 'forg':124C 'genuin':140C 'header':111C 'hook':109C 'know':115C 'miss':88C 'n8n':78C 'new':98C 'pass':128C 'reject':143C 'replac':120C 'request':104C 'secret':101C,110C,122C 'send':123C 'signatur':129C 'trigger':94C,132C 'unauthent':112C 'url':118C 'verif':100C,130C 'vulner':90C 'webhook':99C,117C 'workflow':133C 'x':83C,108C 'x-hook-secret':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126382","severity":null,"published_at":"2026-11-13T10:17:41+00:00","modified_at":"2026-11-13T10:17:41+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","fetched_at":"2026-11-13T10:47:17+00:00","note":null}],"documents":[{"id":110629,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-28T08:48:49+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145007,"url":"https://www.vulncheck.com/advisories/n8n-before-2.38.0-authentication-bypass-via-asana-trigger-webhook-secret-reset","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}