Vulnerabilities / CVE-2026-118679

CVE-2026-118679

Published 2026-10-28 · published (not yet in NVD)

CVE-2026-118679

n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger

6.9 MEDIUM
CVSS 4.0 · CNA

0.3%
chance of exploitation in the next 30 days (EPSS; higher than 19% of CVEs)

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.

Scores

6.9CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:NCNA

7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:NCNA

Affected products

n8n-io n8n: < 1.123.83
n8n-io n8n: 2.42.0 to < 2.42.1
n8n-io n8n: 2.0.0 to < 2.41.4

Weakness: CWE-918

Also known as: GHSA-3c3p-5959-3ghr

2 references (advisories, patches, write-ups)

https://github.com/n8n-io/n8n/security/advisories/GHSA-3c3p-5959-3ghr · vendor-advisory
https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-slack-token-exfiltration-via-slack-trigger · third-party-advisory

Sources: CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVE Check your dependencies Scan a website