Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-118679 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.6 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/n8n-io/n8n/security/advisories/GHSA-3c3p-5959-3ghr	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-slack-token-exfiltration-via-slack-trigger	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-918	Server-Side Request Forgery (SSRF)	[email protected]

Affected Products

Product	Versions
n8n	< 1.123.83 (semver) < 2.42.1 (semver) < 2.41.4 (semver)
CPE cpe:2.3:a:n8n:n8n::::::node.js::* Remediation Upgrade: >= 1.123.83moderate effort Upgrade: >= 2.42.1moderate effort Upgrade: >= 2.41.4moderate effort Mitigation:low effort Set a Signature Secret on all Slack API credentials used with the Slack Trigger node so that the signature check does not fail open. Mitigation:low effort Disable the "Download Files" option on any active Slack Trigger nodes. Mitigation:low effort Restrict network-level access to the n8n webhook endpoint to Slack's published IP ranges only. Mitigation:low effort Enable SSRF protection by setting N8N_SSRF_PROTECTION_ENABLED=true. Mitigation:low effort Rotate any Slack OAuth tokens associated with Slack Trigger workflows that may have been exposed.

Product

Versions

n8n

< 1.123.83 (semver)

< 2.42.1 (semver)

< 2.41.4 (semver)

CPE

cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*

Remediation

Upgrade: >= 1.123.83moderate effort
Upgrade: >= 2.42.1moderate effort
Upgrade: >= 2.41.4moderate effort
Mitigation:low effort
Set a Signature Secret on all Slack API credentials used with the Slack Trigger node so that the signature check does not fail open.
Mitigation:low effort
Disable the "Download Files" option on any active Slack Trigger nodes.
Mitigation:low effort
Restrict network-level access to the n8n webhook endpoint to Slack's published IP ranges only.
Mitigation:low effort
Enable SSRF protection by setting N8N_SSRF_PROTECTION_ENABLED=true.
Mitigation:low effort
Rotate any Slack OAuth tokens associated with Slack Trigger workflows that may have been exposed.

Change History

2 change records found show changes

Date	Action	Recorded By
Nov 4, 2026	CVE Modified	CISA-ADP
Oct 28, 2026	New CVE Received	[email protected]