4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-mqpr-49jj-32rc

GHSA-mqpr-49jj-32rc: n8n: Webhook Forgery on Github Webhook Trigger

Impact

An attacker who knows the webhook URL of a workflow using the GitHub Webhook Trigger node could send unsigned POST requests and trigger the workflow with arbitrary data. The node did not implement the HMAC-SHA256 signature verification that GitHub provides to authenticate webhook deliveries, allowing any party to spoof GitHub webhook events.

Patches

The issue has been fixed in n8n versions 2.5.0 and 1.123.15. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit workflow creation and editing permissions to fully trusted users only.
Restrict network access to the n8n webhook endpoint to known GitHub webhook IP ranges.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-mqpr-49jj-32rc

GHSA-mqpr-49jj-32rc:

4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 1.123.15	1.123.15
n8n	npm	>= 2.0.0, < 2.5.0	2.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-mqpr-49jj-32rc, is an authentication bypass in the n8n GitHub Trigger Node. The root cause is the failure to verify the HMAC-SHA256 signature of incoming webhook requests. An attacker can exploit this by sending a POST request to the known webhook URL, which would trigger the associated workflow with malicious data.

The analysis of the provided patches, specifically commit afe322325502f448b33bff1db1575e4447c28a36, points directly to the vulnerable function. The webhook method within the GithubTrigger class in packages/nodes-base/nodes/Github/GithubTrigger.node.ts is the function responsible for handling these incoming requests. Before the patch, this function would immediately start processing the request body. The patch remediates the vulnerability by adding a signature verification step at the very beginning of this webhook method. Any request that fails this check is now rejected with a 401 Unauthorized error. Therefore, during exploitation of a vulnerable version, the GithubTrigger.webhook function would be the primary indicator in a runtime profile or stack trace.

Vulnerable functions

GithubTrigger.webhook

packages/nodes-base/nodes/Github/GithubTrigger.node.ts

The `GithubTrigger.webhook` method is the entry point for handling incoming GitHub webhook requests. Prior to the patch, this method processed the request body without verifying the cryptographic signature sent by GitHub. This allowed an attacker who knew the webhook's URL to send a forged POST request with arbitrary data, triggering the workflow as if the request came from GitHub. The patch introduces a call to a new `verifySignature` function at the beginning of the method to authenticate the request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-mqpr-49jj-32rc: n8n: Webhook Forgery on Github Webhook Trigger

Impact

Patches

Workarounds

GHSA-mqpr-49jj-32rc:

4

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-mqpr-49jj-32rc: n8n: Webhook Forgery on Github Webhook Trigger

Impact

Patches

Workarounds

Basic Information

Basic Information

4

4

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI