The vulnerability is a server‑side request forgery in the Slack Trigger webhook of n8n. When no signing secret is configured, an unauthenticated attacker can submit a request with a custom file‑name parameter that causes the node to download the workspace access token and forward it to the attacker’s host. The affected token grants bearer access to Slack resources, allowing an attacker to intercept or misuse the token. This flaw falls under CWE‑918 (Server‑Side Request Forgery).

n8n-io’s n8n workflow automation platform is affected. Versions prior to 1.123.83, 2.41.4, and 2.42.1 contain the flaw. The flaw is specific to the Slack Trigger webhook component.

The CVSS score of 6.9 indicates a moderate severity. The exploit requires knowledge of the Slack trigger webhook URL but does not require any authentication. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, so the current present exploitation risk is moderate but potentially increased if the webhook URL is publicly known. The presence of a user‑configurable signing secret is an important mitigator.