What is GHSA-r9rf-g62g-xq7v?

GHSA-r9rf-g62g-xq7v is a security advisory published by GitHub Security Advisories with Medium severity. n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in...

Which CVE IDs does GHSA-r9rf-g62g-xq7v cover?

GHSA-r9rf-g62g-xq7v covers the following CVE IDs: CVE-2026-118679. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r9rf-g62g-xq7v?

GHSA-r9rf-g62g-xq7v has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-r9rf-g62g-xq7vMediumCVSS 7.5

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in...

Vendor

GitHub Security Advisories

Published

October 28, 2026

Last Modified

October 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-118679 →

📋 Description

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.

🔗 References (4)

https://github.com/n8n-io/n8n/security/advisories/GHSA-3c3p-5959-3ghr
https://nvd.nist.gov/vuln/detail/CVE-2026-118679
https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-slack-token-exfiltration-via-slack-trigger
https://github.com/advisories/GHSA-r9rf-g62g-xq7v