CVE-2026-126382

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.38.0 n8n versions 3.x prior to 3.0.1

Description The Asana Trigger lacks proper authentication, allowing it to accept a new webhook verification secret from any request that includes an X-Hook-Secret header. An unauthenticated attacker with knowledge of the webhook URL can replace the existing secret and send forged Asana events. These forged events pass signature verification, enabling the attacker to trigger workflows using controlled data, which subsequently causes genuine deliveries to be rejected.

Recommendations Update n8n to version 2.38.0 or later. Update n8n to version 3.0.1 or later.