---
id: "CVE-2026-126382"
page: "https://infrastack.ai/live/CVE-2026-126382"
kind: "vulnerability"
aliases: ["CVE-2026-126382"]
title: "n8n: Asana Trigger accepts forged webhook secrets from any request"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "asana", "n8n", "self-hosted"]
not_affected_if: ["fixed-version", "no-asana-trigger"]
published_at: "2026-11-13T10:17:41+00:00"
first_seen_at: "2026-11-13T10:47:17+00:00"
updated_at: "2026-11-13T10:55:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126382", "first_seen_at": "2026-11-13T10:47:17+00:00"}]
exploit_sources: []
---

# n8n: Asana Trigger accepts forged webhook secrets from any request

Link for people: https://infrastack.ai/live/CVE-2026-126382 (this .md is for agents)

The n8n workflow automation tool's Asana Trigger node accepts a new webhook verification secret from any request carrying an X-Hook-Secret header, without authentication. An unauthenticated attacker who knows the webhook URL can replace the secret, forge Asana events that pass verification, and start workflows with attacker-controlled data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the n8n version with `n8n --version` or the instance's settings page; affected versions are before `2.38.0` and `3.x` before `3.0.1`.
- Check whether any workflow uses the Asana Trigger node.

## Fix

- n8n before `2.38.0`: move to `2.38.0`
- n8n `3.x` before `3.0.1`: move to `3.0.1`

## Timeline

- 2026-11-13T10:47:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126382

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/n8n-before-2.38.0-authentication-bypass-via-asana-trigger-webhook-secret-reset

## From the sources

n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accepts a new webhook verification secret from any request carrying an X-Hook-Secret header. Unauthenticated attackers who know the webhook URL can replace the secret, send forged Asana events that pass signature verification, and trigger workflows with attacker-controlled data while genuine deliveries are rejected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_