Vulnerability Details CVE-2026-56360
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data.
Exploit prediction scoring system (EPSS) score
CVSS Severity
CVSS v3 Score 4.0