CVE-2026-56360: n8n Zendesk Webhook Signature Verification Flaw

Technical summary

CVE-2026-56360 is a cryptographic verification failure (CWE-290) in n8n's ZendeskTrigger node implementation. The flaw lies in incomplete HMAC-SHA256 signature validation on incoming Zendesk webhooks. An unauthenticated attacker who discovers or predicts a webhook URL can craft and send POST requests with malicious payloads that the trigger node will process as legitimate Zendesk events. The CVSS 3.1 score of 4.0 reflects the network-accessible attack vector, high complexity (requires knowledge of the specific webhook URL), and integrity impact limited to the workflow execution context rather than the underlying application or infrastructure.

Business impact

This vulnerability poses a moderate operational risk to organizations using n8n's Zendesk integration for customer service automation. A successful attack could corrupt customer support data flows, trigger unintended actions (such as ticket creation, assignment, or status changes), or inject false information into downstream systems connected to the workflow. In scenarios where webhooks trigger sensitive operations—such as escalations, notifications to external teams, or data synchronization—malicious payloads could damage data integrity and create compliance or SLA violations. The impact is typically limited to a single workflow and its connected systems, not a platform-wide breach.

Affected systems

n8n versions prior to 1.123.18 (for the 1.x series) and prior to 2.6.2 (for the 2.x series) are affected. The vulnerability is specific to deployments that have configured the ZendeskTrigger node to receive webhook events. Self-hosted n8n instances, n8n Cloud deployments, and organizations using n8n as an embedded workflow engine are all potentially vulnerable if they use this integration. Versions 1.123.18, 2.6.2, and later remediate the issue.

Exploitability

Exploitation requires two conditions: knowledge of a deployed webhook URL and network access to the n8n instance hosting the trigger node. The webhook URL is typically not publicly advertised, but may be discoverable through reconnaissance, accidental exposure, or insider knowledge. Once the URL is known, crafting a malicious POST request is trivial—no special tools, zero-days, or interaction from the victim is required. The CVSS complexity rating of 'high' reflects the practical barrier of obtaining the webhook URL rather than any inherent technical difficulty in the attack itself. This is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Immediate action is to upgrade affected n8n instances to version 1.123.18 or 2.6.2 or later. Organizations running version 1.x should upgrade to 1.123.18 or migrate to the 2.x branch and update to 2.6.2+. For deployment scenarios where immediate patching is constrained, implement network-level access controls: restrict webhook endpoint access to known Zendesk IP address ranges and/or require authentication tokens in addition to URL knowledge. Rotate webhook URLs after patching to invalidate any URLs that may have been exposed during the vulnerability window.

Patch guidance

Patch availability: n8n has released fixed versions 1.123.18 and 2.6.2. Organizations should consult the official n8n release notes and security advisories to confirm the patch version appropriate for their deployment model (cloud-hosted vs. self-hosted). Self-hosted deployments can pull the patched Docker image or install the fixed npm package version. Cloud-hosted instances may receive patches automatically; verify your cloud instance version post-update. After patching, regenerate webhook URLs and re-configure any Zendesk integrations to ensure fresh signature validation is in effect.

Detection guidance

Monitor n8n audit logs and workflow execution history for unusual ZendeskTrigger activations, particularly those originating from unexpected source IP addresses or containing payloads that deviate from normal Zendesk webhook schema. Inspect POST requests to webhook endpoints for the presence or absence of the 'X-Zendesk-Webhook-Signature' or equivalent HMAC header; unsigned or malformed signatures should trigger alerts. Enable verbose logging on the ZendeskTrigger node if available. Organizations with HTTP request logging upstream (e.g., reverse proxy, API gateway) should examine request patterns for spike activity against known webhook URLs. Correlation with Zendesk event logs can confirm whether suspicious n8n trigger activations correspond to genuine Zendesk events.

Why prioritize this

While the CVSS score is moderate (4.0), prioritize patching based on your use of Zendesk webhooks in n8n and the sensitivity of downstream systems. If your ZendeskTrigger workflows modify customer records, trigger billing operations, or feed into compliance-sensitive processes, treat this with higher urgency. Organizations with only informational or read-only Zendesk integrations face lower risk. Factor in exposure: webhook URL discovery is possible through log files, configuration exports, or insider access. Given the ease of exploitation once the URL is known and the integrity impact to workflow data, patching within 30 days is recommended.

Risk score, explained

The CVSS 3.1 score of 4.0 (MEDIUM) reflects: (1) network-accessible attack vector (AV:N) with no authentication required; (2) high attack complexity (AC:H) due to the need to discover/predict the webhook URL; (3) no direct confidentiality impact (C:N); (4) limited integrity impact (I:L) scoped to the individual workflow and its immediate outputs rather than the broader system (S:C reflects changed scope, meaning impact is contained to the application context); (5) no availability impact (A:N). The score accurately captures that this is a real vulnerability but not a critical platform compromise—the barrier to exploitation is moderate, and the damage is localized to data integrity within a specific workflow execution.

Frequently asked questions