{"id":"GHSA-mx4r-96jx-v278","kind":"vulnerability","aliases":["GHSA-mx4r-96jx-v278"],"related":[],"title":"Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret","description":"## Impact\n\nThe Asana Trigger accepted a new webhook verification secret from any request carrying an `X-Hook-Secret` header. An unauthenticated attacker who knows the webhook URL could replace the secret, send forged Asana events that pass signature verification, and trigger the workflow with attacker-controlled data. Genuine Asana deliveries were rejected afterwards.\n\n## Patches\n\nThe issue has been fixed in n8n version 2.38.0 and 3.0.1. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict network-level access to the Asana Trigger webhook endpoint.\n- Deactivate Asana Trigger workflows until the instance is patched.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"The n8n Asana Trigger node accepts a new webhook verification secret from any request that carries an X-Hook-Secret header. An unauthenticated attacker who knows the webhook URL can replace the secret, forge Asana events that pass verification, and start the workflow with attacker-controlled data.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 2.38.0"],"affected":"< 2.38.0","ecosystem":"npm"},{"name":"n8n","fixed":[">= 3.0.1"],"affected":"< 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["asana","n8n","package","self-hosted","webhooks"],"not_affected_if":["network-restricted-webhooks","no-asana-trigger-workflows"],"how_to_check":"- Check the installed n8n version with `n8n --version` or `npm ls n8n` and compare it to the fixed versions.\n- Look for workflows that use the Asana Trigger node and note whether their webhook URLs are reachable from the internet.","fix":"- n8n `2.38.0` for the 2.x line\n- n8n `3.0.1` for the 3.x line","status":"open","published_at":"2026-10-28T08:48:49+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","triaged_at":"2026-11-09T22:55:01+00:00","updated_at":"2026-11-09T22:55:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:55:01Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `2.38.0` for the 2.x line\n- n8n `3.0.1` for the 3.x line","reach":"internet","title":"n8n: Asana Trigger lets unauthenticated requests reset webhook secret","impact":"medium","summary":"The n8n Asana Trigger node accepts a new webhook verification secret from any request that carries an X-Hook-Secret header. An unauthenticated attacker who knows the webhook URL can replace the secret, forge Asana events that pass verification, and start the workflow with attacker-controlled data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["n8n","self-hosted","asana","webhooks"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker triggers workflows with forged Asana events, injecting data","analyst_note":"","how_to_check":"- Check the installed n8n version with `n8n --version` or `npm ls n8n` and compare it to the fixed versions.\n- Look for workflows that use the Asana Trigger node and note whether their webhook URLs are reachable from the internet.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-asana-trigger-workflows","network-restricted-webhooks"],"who_is_affected":"Teams that run self-hosted n8n with at least one workflow using the Asana Trigger node are exposed, because the webhook URL is the only thing an attacker needs to know. Instances where no Asana Trigger workflows exist, or where the webhook endpoint is not reachable from outside the network, are lower risk. n8n Cloud users are handled by the vendor, but the sources do not say when it was patched.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000794,"input_tokens":4849,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'2.38.0':142C '3.0.1':144C '96jx':13A,18A 'accept':34B,82C 'access':175C 'administr':164C 'afterward':132C 'asana':1A,22B,31B,64B,80C,112C,128C,178C,183C 'attack':53B,75B,100C,124C 'attacker-control':74B,123C 'carri':44B,91C 'consid':166C 'control':76B,125C 'could':106C 'data':77B,126C 'deactiv':182C 'deliveri':129C 'endpoint':181C 'event':65B,113C 'fix':138C 'follow':168C 'forg':63B,111C 'fulli':195C 'genuin':127C 'ghsa':11A,16A 'ghsa-mx4r-96jx-v278':10A,15A 'header':50B,97C 'hook':48B,95C 'host':27B 'immedi':162C 'impact':78C 'instanc':188C 'issu':135C 'know':55B,102C 'later':152C 'level':174C 'measur':209C 'mitig':170C,208C 'mx4r':12A,17A 'n8n':20A,21A,23B,30B,140C 'network':173C 'network-level':172C 'new':36B,84C 'node':33B 'packag':24B 'pass':67B,115C 'patch':133C,190C 'possibl':163C 'reject':131C 'remedi':154C,196C 'replac':60B,107C 'request':4A,42B,90C 'reset':6A 'restrict':171C 'risk':198C 'secret':9A,39B,49B,62B,87C,96C,109C 'self':26B 'self-host':25B 'send':110C 'short':206C 'short-term':205C 'signatur':116C 'start':70B 'temporari':169C 'term':207C 'trigger':2A,32B,81C,119C,179C,184C 'unauthent':3A,52B,99C 'upgrad':147C,159C 'url':58B,105C 'use':203C 'user':145C 'v278':14A,19A 'verif':8A,38B,68B,86C,117C 'version':141C,150C 'vulner':156C 'webhook':7A,28B,37B,57B,85C,104C,180C 'workaround':157C,192C 'workflow':72B,121C,185C 'x':47B,94C 'x-hook-secret':46B,93C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted n8n with at least one workflow using the Asana Trigger node are exposed, because the webhook URL is the only thing an attacker needs to know. Instances where no Asana Trigger workflows exist, or where the webhook endpoint is not reachable from outside the network, are lower risk. n8n Cloud users are handled by the vendor, but the sources do not say when it was patched.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["asana","medium","n8n","npm","package","selfhosted","webhooks"],"campaign_type":null,"search_a":"'96jx':13A,18A 'asana':1A 'ghsa':11A,16A 'ghsa-mx4r-96jx-v278':10A,15A 'mx4r':12A,17A 'n8n':20A,21A 'request':4A 'reset':6A 'secret':9A 'trigger':2A 'unauthent':3A 'v278':14A,19A 'verif':8A 'webhook':7A","search_b":"'accept':34B 'asana':22B,31B,64B 'attack':53B,75B 'attacker-control':74B 'carri':44B 'control':76B 'data':77B 'event':65B 'forg':63B 'header':50B 'hook':48B 'host':27B 'know':55B 'n8n':23B,30B 'new':36B 'node':33B 'packag':24B 'pass':67B 'replac':60B 'request':42B 'secret':39B,49B,62B 'self':26B 'self-host':25B 'start':70B 'trigger':32B 'unauthent':52B 'url':58B 'verif':38B,68B 'webhook':28B,37B,57B 'workflow':72B 'x':47B 'x-hook-secret':46B","search_c":"'2.38.0':142C '3.0.1':144C 'accept':82C 'access':175C 'administr':164C 'afterward':132C 'asana':80C,112C,128C,178C,183C 'attack':100C,124C 'attacker-control':123C 'carri':91C 'consid':166C 'control':125C 'could':106C 'data':126C 'deactiv':182C 'deliveri':129C 'endpoint':181C 'event':113C 'fix':138C 'follow':168C 'forg':111C 'fulli':195C 'genuin':127C 'header':97C 'hook':95C 'immedi':162C 'impact':78C 'instanc':188C 'issu':135C 'know':102C 'later':152C 'level':174C 'measur':209C 'mitig':170C,208C 'n8n':140C 'network':173C 'network-level':172C 'new':84C 'pass':115C 'patch':133C,190C 'possibl':163C 'reject':131C 'remedi':154C,196C 'replac':107C 'request':90C 'restrict':171C 'risk':198C 'secret':87C,96C,109C 'send':110C 'short':206C 'short-term':205C 'signatur':116C 'temporari':169C 'term':207C 'trigger':81C,119C,179C,184C 'unauthent':99C 'upgrad':147C,159C 'url':105C 'use':203C 'user':145C 'verif':86C,117C 'version':141C,150C 'vulner':156C 'webhook':85C,104C,180C 'workaround':157C,192C 'workflow':121C,185C 'x':94C 'x-hook-secret':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-mx4r-96jx-v278","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278","severity":"medium","published_at":"2026-10-28T08:48:49+00:00","modified_at":"2026-10-28T08:48:49+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","fetched_at":"2026-11-09T22:53:25+00:00","note":null}],"documents":[{"id":110629,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}