6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21894

CVE-2026-21894: n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks

n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stripe webhook signing secret when registering the webhook endpoint, but incoming webhook requests were not verified against this secret. As a result, any HTTP client that knows the webhook URL could send a POST request containing a matching event type, causing the workflow to execute as if a legitimate Stripe event had been received. This issue affects n8n users who have active workflows using the Stripe Trigger node. An attacker could potentially fake payment or subscription events and influence downstream workflow behavior. The practical risk is reduced by the fact that the webhook URL contains a high-entropy UUID; however, authenticated n8n users with access to the workflow can view this webhook ID. This issue has been patched in version 2.2.2. A temporary workaround for this issue involves users deactivating affected workflows or restricting access to workflows containing Stripe Trigger nodes to trusted users only.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21894

CVE-2026-21894:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	>= 0.150.0, < 2.2.2	2.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the StripeTrigger.node.ts file, specifically within the webhook method of the StripeTrigger class. The advisory states that n8n was not verifying the signature of incoming Stripe webhooks. The provided commit patch confirms this. Before the patch, the webhook method would receive a request and immediately start processing its body without any authentication or signature verification. An attacker who knew the webhook's unique URL could send a forged POST request to trigger the workflow.

The patch rectifies this by introducing a new helper function, verifySignature, in a new file StripeTriggerHelpers.ts. This function implements the required signature verification logic as recommended by Stripe, using a signing secret. The webhook method in StripeTrigger.node.ts is modified to call this new verifySignature function. If the signature is invalid, it now correctly returns a 401 Unauthorized error, preventing the forged request from being processed. Therefore, the StripeTrigger.webhook method is the primary vulnerable function, as it was the entry point that lacked the necessary security control.

Vulnerable functions

StripeTrigger.webhook

packages/nodes-base/nodes/Stripe/StripeTrigger.node.ts

The `webhook` method in the `StripeTrigger` class is responsible for handling incoming webhook requests from Stripe. Prior to the patch, this method did not perform any signature verification. It directly proceeded to process the request body. This allowed an unauthenticated attacker, who knows the webhook URL, to send forged Stripe events and trigger the associated workflow. The patch introduces a call to a new `verifySignature` function at the beginning of the `webhook` method to ensure the authenticity of the request before any further processing.

verifySignature

packages/nodes-base/nodes/Stripe/StripeTriggerHelpers.ts

This is a new helper function added to implement the fix. It contains the logic to verify the Stripe webhook signature. It retrieves the signature from the request headers, checks the timestamp, and computes an HMAC-SHA256 signature of the request body, comparing it in a timing-safe way to the signature provided by Stripe. The absence of this function and its invocation in the `webhook` method is the root cause of the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.