N8N · GHSA-mx4r-96jx-v278 · Package
FIX → >= 2.38.0 +1
The n8n Asana Trigger node accepts a new webhook verification secret from any request that carries an X-Hook-Secret header. An unauthenticated attacker who knows the webhook URL can replace the secret, forge Asana events that pass verification, and start the workflow with attacker-controlled data.
first public Oct 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run self-hosted n8n with at least one workflow using the Asana Trigger node are exposed, because the webhook URL is the only thing an attacker needs to know. Instances where no Asana Trigger workflows exist, or where the webhook endpoint is not reachable from outside the network, are lower risk. n8n Cloud users are handled by the vendor, but the sources do not say when it was patched.
Not affected if network-restricted-webhooks, no-asana-trigger-workflows
Who cares asana, n8n, self-hosted, webhooks
n8n --version or npm ls n8n and compare it to the fixed versions.Upgrade to >= 2.38.0 +1
The Asana Trigger accepted a new webhook verification secret from any request carrying an X-Hook-Secret header. An unauthenticated attacker who knows the webhook URL could replace the secret, send forged Asana events that pass signature verification, and trigger the workflow with attacker-controlled data. Genuine Asana deliveries were rejected afterwards.
The issue has been fixed in n8n version 2.38.0 and 3.0.1. Users should upgrade to this version or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.38.0 for the 2.x line3.0.1 for the 3.x line