{"id":"CVE-2026-86080","title":"n8n is an open source workflow automation platform","summary":"n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow sta…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-347"],"vendor":"n8n","product":"n8n","affected":["n8n < 1.123.76","n8n >= 2.0.0, < 2.37.7","n8n >= 2.38.0, < 2.38.2"],"patched":["n8n 2.38.2"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T18:21:38.147","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86080","references":[{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-5m98-cgcr-xx3q","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86080"},{"url":"https://github.com/advisories/GHSA-5m98-cgcr-xx3q"}],"tags":["nvd","cve.org","ghsa","npm"],"epss":0.00159,"epssPercentile":0.05478,"aliases":["GHSA-5m98-cgcr-xx3q"],"ecosystem":"npm","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T13:16:22.812821Z"},"scores":{"nvd":5.3,"cna":6.3},"ingestedAt":"2026-09-08T22:12:31.038Z","slug":"CVE-2026-86080","body":"## Overview\n\nn8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and X-Hub-Signature-256 verification accepted deliveries without a stored secret. The affected logic includes packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts and the 422 webhook reuse path. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.\n\n## Affected\n\n- `n8n < 1.123.76`\n- `n8n >= 2.0.0, < 2.37.7`\n- `n8n >= 2.38.0, < 2.38.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `n8n 2.38.2`\n\n## Package advisory (CVE-2026-86080)\n\nAffected packages:\n\n- `n8n < 1.123.76`\n- `n8n >= 2.38.0, < 2.38.2`\n- `n8n >= 2.0.0, < 2.37.7`\n\nPatched in:\n\n- `n8n 1.123.76`\n- `n8n 2.38.2`\n- `n8n 2.37.7`\n\nSource: https://github.com/advisories/GHSA-5m98-cgcr-xx3q","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202070,"id":"CVE-2026-86080","ts":1789400047505,"field":"cvss","old":"6.3","new":"5.3"},{"seq":200797,"id":"CVE-2026-86080","ts":1789397615787,"field":"cvss","old":"5.3","new":"6.3"},{"seq":199490,"id":"CVE-2026-86080","ts":1789395521112,"field":"cvss","old":"6.3","new":"5.3"},{"seq":198735,"id":"CVE-2026-86080","ts":1789392243394,"field":"cvss","old":"5.3","new":"6.3"},{"seq":197068,"id":"CVE-2026-86080","ts":1789384291796,"field":"cvss","old":"6.3","new":"5.3"},{"seq":194197,"id":"CVE-2026-86080","ts":1789378782454,"field":"cvss","old":"5.3","new":"6.3"},{"seq":192984,"id":"CVE-2026-86080","ts":1789376514440,"field":"cvss","old":"6.3","new":"5.3"},{"seq":191771,"id":"CVE-2026-86080","ts":1789373630466,"field":"cvss","old":"5.3","new":"6.3"},{"seq":190556,"id":"CVE-2026-86080","ts":1789369474689,"field":"cvss","old":"6.3","new":"5.3"},{"seq":189343,"id":"CVE-2026-86080","ts":1789368408405,"field":"cvss","old":"5.3","new":"6.3"},{"seq":188126,"id":"CVE-2026-86080","ts":1789365230102,"field":"cvss","old":"6.3","new":"5.3"},{"seq":186913,"id":"CVE-2026-86080","ts":1789363470658,"field":"cvss","old":"5.3","new":"6.3"},{"seq":185699,"id":"CVE-2026-86080","ts":1789361228441,"field":"cvss","old":"6.3","new":"5.3"},{"seq":184486,"id":"CVE-2026-86080","ts":1789358363047,"field":"cvss","old":"5.3","new":"6.3"},{"seq":182737,"id":"CVE-2026-86080","ts":1789354316462,"field":"cvss","old":"6.3","new":"5.3"},{"seq":181530,"id":"CVE-2026-86080","ts":1789353317068,"field":"cvss","old":"5.3","new":"6.3"},{"seq":180323,"id":"CVE-2026-86080","ts":1789350284087,"field":"cvss","old":"6.3","new":"5.3"},{"seq":179116,"id":"CVE-2026-86080","ts":1789348292233,"field":"cvss","old":"5.3","new":"6.3"},{"seq":177909,"id":"CVE-2026-86080","ts":1789346369384,"field":"cvss","old":"6.3","new":"5.3"},{"seq":176702,"id":"CVE-2026-86080","ts":1789343183888,"field":"cvss","old":"5.3","new":"6.3"},{"seq":174819,"id":"CVE-2026-86080","ts":1789334875018,"field":"cvss","old":"6.3","new":"5.3"},{"seq":173614,"id":"CVE-2026-86080","ts":1789333686197,"field":"cvss","old":"5.3","new":"6.3"},{"seq":172428,"id":"CVE-2026-86080","ts":1789331092373,"field":"cvss","old":"6.3","new":"5.3"},{"seq":171242,"id":"CVE-2026-86080","ts":1789328780256,"field":"cvss","old":"5.3","new":"6.3"},{"seq":170037,"id":"CVE-2026-86080","ts":1789327196522,"field":"cvss","old":"6.3","new":"5.3"},{"seq":168832,"id":"CVE-2026-86080","ts":1789323839420,"field":"cvss","old":"5.3","new":"6.3"},{"seq":167627,"id":"CVE-2026-86080","ts":1789319701807,"field":"cvss","old":"6.3","new":"5.3"},{"seq":166422,"id":"CVE-2026-86080","ts":1789318775499,"field":"cvss","old":"5.3","new":"6.3"},{"seq":165217,"id":"CVE-2026-86080","ts":1789315789315,"field":"cvss","old":"6.3","new":"5.3"},{"seq":164012,"id":"CVE-2026-86080","ts":1789313633652,"field":"cvss","old":"5.3","new":"6.3"},{"seq":162807,"id":"CVE-2026-86080","ts":1789311902772,"field":"cvss","old":"6.3","new":"5.3"},{"seq":161602,"id":"CVE-2026-86080","ts":1789308732592,"field":"cvss","old":"5.3","new":"6.3"},{"seq":159715,"id":"CVE-2026-86080","ts":1789300469963,"field":"cvss","old":"6.3","new":"5.3"},{"seq":156704,"id":"CVE-2026-86080","ts":1789294755016,"field":"cvss","old":"5.3","new":"6.3"},{"seq":155499,"id":"CVE-2026-86080","ts":1789292967295,"field":"cvss","old":"6.3","new":"5.3"},{"seq":154294,"id":"CVE-2026-86080","ts":1789289796933,"field":"cvss","old":"5.3","new":"6.3"},{"seq":151545,"id":"CVE-2026-86080","ts":1789277629230,"field":"cvss","old":"6.3","new":"5.3"},{"seq":150506,"id":"CVE-2026-86080","ts":1789276245033,"field":"cvss","old":"5.3","new":"6.3"},{"seq":149473,"id":"CVE-2026-86080","ts":1789273824081,"field":"cvss","old":"6.3","new":"5.3"},{"seq":148440,"id":"CVE-2026-86080","ts":1789271348120,"field":"cvss","old":"5.3","new":"6.3"},{"seq":146471,"id":"CVE-2026-86080","ts":1789269393968,"field":"cvss","old":"6.3","new":"5.3"},{"seq":145276,"id":"CVE-2026-86080","ts":1789266338957,"field":"cvss","old":"5.3","new":"6.3"},{"seq":144180,"id":"CVE-2026-86080","ts":1789262616126,"field":"cvss","old":"6.3","new":"5.3"},{"seq":143084,"id":"CVE-2026-86080","ts":1789261532814,"field":"cvss","old":"5.3","new":"6.3"},{"seq":141915,"id":"CVE-2026-86080","ts":1789258831143,"field":"cvss","old":"6.3","new":"5.3"},{"seq":140756,"id":"CVE-2026-86080","ts":1789256726536,"field":"cvss","old":"5.3","new":"6.3"},{"seq":139558,"id":"CVE-2026-86080","ts":1789254831425,"field":"cvss","old":"6.3","new":"5.3"},{"seq":138360,"id":"CVE-2026-86080","ts":1789251933618,"field":"cvss","old":"5.3","new":"6.3"},{"seq":137162,"id":"CVE-2026-86080","ts":1789247832106,"field":"cvss","old":"6.3","new":"5.3"},{"seq":135964,"id":"CVE-2026-86080","ts":1789247055374,"field":"cvss","old":"5.3","new":"6.3"}]}