CVE-2026-21894

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21894", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T17:24:36.929Z", "datePublished": "2026-01-08T09:56:04.274Z", "dateUpdated": "2026-01-08T14:42:36.631Z"}, "containers": {"cna": {"title": "n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks", "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5"}, {"name": "https://github.com/n8n-io/n8n/pull/22764", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/pull/22764"}, {"name": "https://github.com/n8n-io/n8n/commit/a61a5991093c41863506888336e808ac1eff8d59", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/commit/a61a5991093c41863506888336e808ac1eff8d59"}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"version": ">= 0.150.0, < 2.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T09:56:04.274Z"}, "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stripe webhook signing secret when registering the webhook endpoint, but incoming webhook requests were not verified against this secret. As a result, any HTTP client that knows the webhook URL could send a POST request containing a matching event type, causing the workflow to execute as if a legitimate Stripe event had been received. This issue affects n8n users who have active workflows using the Stripe Trigger node. An attacker could potentially fake payment or subscription events and influence downstream workflow behavior. The practical risk is reduced by the fact that the webhook URL contains a high-entropy UUID; however, authenticated n8n users with access to the workflow can view this webhook ID. This issue has been patched in version 2.2.2. A temporary workaround for this issue involves users deactivating affected workflows or restricting access to workflows containing Stripe Trigger nodes to trusted users only."}], "source": {"advisory": "GHSA-jf52-3f2h-h9j5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T14:42:25.243654Z", "id": "CVE-2026-21894", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T14:42:36.631Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21894", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T14:42:25.243654Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T14:42:31.684Z"}}], "cna": {"title": "n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks", "source": {"advisory": "GHSA-jf52-3f2h-h9j5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": ">= 0.150.0, < 2.2.2"}]}], "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5", "name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/n8n-io/n8n/pull/22764", "name": "https://github.com/n8n-io/n8n/pull/22764", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/n8n-io/n8n/commit/a61a5991093c41863506888336e808ac1eff8d59", "name": "https://github.com/n8n-io/n8n/commit/a61a5991093c41863506888336e808ac1eff8d59", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stripe webhook signing secret when registering the webhook endpoint, but incoming webhook requests were not verified against this secret. As a result, any HTTP client that knows the webhook URL could send a POST request containing a matching event type, causing the workflow to execute as if a legitimate Stripe event had been received. This issue affects n8n users who have active workflows using the Stripe Trigger node. An attacker could potentially fake payment or subscription events and influence downstream workflow behavior. The practical risk is reduced by the fact that the webhook URL contains a high-entropy UUID; however, authenticated n8n users with access to the workflow can view this webhook ID. This issue has been patched in version 2.2.2. A temporary workaround for this issue involves users deactivating affected workflows or restricting access to workflows containing Stripe Trigger nodes to trusted users only."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T09:56:04.274Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21894", "state": "PUBLISHED", "dateUpdated": "2026-01-08T14:42:36.631Z", "dateReserved": "2026-01-05T17:24:36.929Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-08T09:56:04.274Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n8n", "vendor": "n8n-io", "versions": [{"status": "affected", "version": ">= 0.150.0, < 2.2.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "7E294540-A745-4668-9F5B-157B29DB92CC", "versionEndExcluding": "2.2.2", "versionStartIncluding": "0.150.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stripe webhook signing secret when registering the webhook endpoint, but incoming webhook requests were not verified against this secret. As a result, any HTTP client that knows the webhook URL could send a POST request containing a matching event type, causing the workflow to execute as if a legitimate Stripe event had been received. This issue affects n8n users who have active workflows using the Stripe Trigger node. An attacker could potentially fake payment or subscription events and influence downstream workflow behavior. The practical risk is reduced by the fact that the webhook URL contains a high-entropy UUID; however, authenticated n8n users with access to the workflow can view this webhook ID. This issue has been patched in version 2.2.2. A temporary workaround for this issue involves users deactivating affected workflows or restricting access to workflows containing Stripe Trigger nodes to trusted users only."}, {"lang": "es", "value": "n8n es una plataforma de automatizaci\u00f3n de flujos de trabajo de c\u00f3digo abierto. En versiones desde la 0.150.0 hasta antes de la 2.2.2, una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en el nodo Stripe Trigger permite a partes no autenticadas activar flujos de trabajo enviando eventos webhook de Stripe falsificados. El Stripe Trigger crea y almacena un secreto de firma de webhook de Stripe al registrar el punto final del webhook, pero las solicitudes de webhook entrantes no se verificaban contra este secreto. Como resultado, cualquier cliente HTTP que conoce la URL del webhook podr\u00eda enviar una solicitud POST que contenga un tipo de evento coincidente, haciendo que el flujo de trabajo se ejecute como si se hubiera recibido un evento de Stripe leg\u00edtimo. Este problema afecta a los usuarios de n8n que tienen flujos de trabajo activos usando el nodo Stripe Trigger. Un atacante podr\u00eda potencialmente falsificar eventos de pago o suscripci\u00f3n e influir en el comportamiento del flujo de trabajo posterior. El riesgo pr\u00e1ctico se reduce por el hecho de que la URL del webhook contiene un UUID de alta entrop\u00eda; sin embargo, los usuarios autenticados de n8n con acceso al flujo de trabajo pueden ver este ID de webhook. Este problema ha sido parcheado en la versi\u00f3n 2.2.2. Una soluci\u00f3n alternativa temporal para este problema implica que los usuarios desactiven los flujos de trabajo afectados o restrinjan el acceso a los flujos de trabajo que contienen nodos Stripe Trigger solo a usuarios de confianza."}], "id": "CVE-2026-21894", "lastModified": "2026-06-17T10:19:06.333", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21894", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T14:42:25.243654Z", "version": "2.0.3"}}]}, "published": "2026-01-08T10:15:55.970", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/n8n-io/n8n/commit/a61a5991093c41863506888336e808ac1eff8d59"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/n8n-io/n8n/pull/22764"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:43:45.584597+00:00", "value": {"mitigation_remediation": ["Upgrade n8n to version 2.2.2 or later to apply the official patch.", "If an upgrade is not yet possible, temporarily deactivate any workflows that use the Stripe Trigger node.", "Restrict access to workflows containing Stripe Trigger nodes so that only trusted users can view the webhook URL and manage the workflow."], "summary": {"action": "Update Immediately", "impact": "Unauthenticated Execution of Workflows"}, "threat_synthesis": {"affected_systems": "The vulnerability affects n8n versions from 0.150.0 through 2.2.1, inclusive. Any deployment running one or more active workflows that incorporate a Stripe Trigger node before the 2.2.2 release is susceptible, regardless of whether the webhook URL is protected. Although the URL contains a high\u2011entropy UUID, it is viewable to any authenticated user who can access the workflow, thereby reducing practical barriers for an attacker.", "description_and_impact": "An authentication bypass flaw in n8n\u2019s Stripe Trigger node permits an unauthenticated user to simulate Stripe webhook events. Because incoming webhook requests are not verified against a stored signing secret, any HTTP client that knows the webhook\u2019s endpoint can POST a fabricated event, causing the associated workflow to run as if a legitimate Stripe notification had been received. The flaw is an instance of authentication bypass (CWE\u2011290) and can be used to feign payment or subscription actions, potentially altering downstream workflow flows.", "risk_and_exploitability": "The CVSS base score of 6.5 indicates a moderate level of risk, and the EPSS score of less than 1 percent suggests a low probability of exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires simply knowing the webhook URL and sending a POST request that mimics a valid Stripe event type; no software exploits or privileged access are required. Because no verification of the Stripe signature occurs, a crafted request will be accepted and the workflow executed under the privileges of the deployment."}}}}, "created": "2026-01-12T14:38:24.645703+00:00", "updated": "2026-04-18T07:45:24.984878+00:00", "vendors": ["n8n", "n8n$PRODUCT$n8n"]}