CVE-2026-54308
High · 7.2CVSS
7.2
EPSS
0.3%
Published
Jun 23, 2026
CISA due date
—
The record
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | n8n | 0 | 2.25.7 |
| npm | n8n | 2.26.0 | 2.26.2 |
Related vulnerabilities
- GHSA-jvc7-762p-3743 n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes Same vulnerability
- CVE-2026-54307 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54304 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54305 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54306 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54302 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54301 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-49465 n8n is an open source workflow automation platform. Also affects n8n