CVE-2026-54308: n8n Webhook Authentication Bypass in MicrosoftAgent365Trigger and StripeTrigger

Technical summary

The MicrosoftAgent365Trigger and StripeTrigger nodes in n8n lack request validation mechanisms for inbound webhooks. This absence of authentication allows an unauthenticated attacker to forge webhook payloads and invoke workflow execution with arbitrary data. The vulnerability stems from insufficient input validation (CWE-290: Improper Input Validation) rather than a cryptographic or signature-verification failure. An attacker with knowledge of the webhook URL—which may be guessed, enumerated, or obtained through other means—can craft requests that the trigger nodes will accept and process without verification, leading to unauthorized workflow execution.

Business impact

Organizations using n8n for workflow automation with MicrosoftAgent365Trigger or StripeTrigger nodes face risk of data tampering, fraudulent transactions, or unintended business process execution. If these triggers are integrated with payment systems, CRM platforms, or other sensitive processes, an attacker could inject malicious data that corrupts records, initiates unintended transactions, or diverts information. The broad network accessibility (AV:N in the CVSS vector) and absence of authentication requirements mean any attacker on the internet can attempt exploitation without credentials, increasing the attack surface for multi-tenant or cloud-hosted n8n instances.

Affected systems

n8n versions prior to 2.25.7 and 2.26.2 are vulnerable. This includes the current 2.25.x branch (up to 2.25.6) and the 2.26.x branch (up to 2.26.1). Any n8n instance that deploys workflows containing either MicrosoftAgent365Trigger or StripeTrigger nodes and exposes these workflows via public webhook URLs is at risk. Self-hosted and cloud-hosted n8n deployments are equally vulnerable if not patched.

Exploitability

Exploitability is straightforward once a webhook URL is known. The attack requires no special tools, authentication, or user interaction—only network access and knowledge of the target webhook endpoint. Attackers can forge HTTP requests with custom payloads to trigger workflows. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects low complexity and no prerequisites, making this vulnerability practical for adversaries with basic HTTP manipulation capabilities. However, successful exploitation depends on the attacker discovering the webhook URL, which may involve enumeration, social engineering, or information disclosure in logs.

Remediation

Upgrade n8n to version 2.25.7 or 2.26.2 or later, depending on your deployment branch. These patched versions implement request validation for the affected trigger nodes. For organizations unable to patch immediately, consider restricting network access to webhook endpoints using firewall rules, API gateways, or IP allowlisting. Disable or remove MicrosoftAgent365Trigger and StripeTrigger nodes from production workflows until patching is complete. Implement additional authentication layers in downstream processes that consume webhook data to mitigate the impact of forged payloads.

Patch guidance

Review your n8n deployment and identify which version branch you are running. If you are on 2.25.x, upgrade to 2.25.7 or later. If you are on 2.26.x, upgrade to 2.26.2 or later. Consult the official n8n release notes and security advisories to confirm patch availability and any breaking changes. Test patched versions in a staging environment before production deployment to ensure compatibility with your existing workflows. After upgrading, verify that the affected trigger nodes are functioning as expected and that webhook validation is now active.

Detection guidance

Monitor webhook access logs for requests to known MicrosoftAgent365Trigger or StripeTrigger endpoints that originate from unexpected sources or contain unusual payload structures. Look for HTTP requests to webhook URLs that do not correlate with legitimate system events (e.g., Stripe webhook requests from non-Stripe IP ranges, MicrosoftAgent365 events from unexpected origins). Inspect n8n audit logs and workflow execution records for triggered workflows that lack a corresponding legitimate event source. If possible, implement request signature validation at the firewall or API gateway level to reject unsigned webhook requests before they reach n8n.

Why prioritize this

This vulnerability merits high priority due to its HIGH severity rating (CVSS 7.2), network accessibility, absence of authentication barriers, and potential for data integrity compromise across multiple business functions. The impact on confidentiality and integrity (C:L/I:L in the CVSS vector) combined with cross-boundary scope (S:C) elevates risk in shared or multi-tenant environments. Organizations with active MicrosoftAgent365Trigger or StripeTrigger deployments should prioritize patching within 7–14 days.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects the combination of network-based attack vector, low complexity, no privilege or user interaction requirements, and multi-system scope. Although the impact on confidentiality and integrity is rated as low, the practical exploitability and ease of forging requests warrant aggressive remediation. The score does not account for the specific business context—organizations relying on these triggers for payment or sensitive data handling should treat the risk as CRITICAL regardless of the base CVSS score.

Frequently asked questions