The vulnerability resides in n8n’s MicrosoftAgent365Trigger and StripeTrigger nodes, which lack validation of inbound webhook requests. An attacker who knows a workflow’s webhook URL can forge a payload that is accepted and processed, causing the workflow to execute with attacker‑controlled data. This flaw is an Authentication Failure (CWE-290) that can lead to unintended workflow actions. The flaw was fixed in n8n 2.25.7 and 2.26.2.

The issue affects the n8n automation platform (n8n-io/n8n) in all versions released before 2.25.7 and before 2.26.2. Administrators should verify that their deployment is not using a vulnerable release.

With a CVSS score of 6.3, the exploit poses moderate risk. The EPSS score is not available, so the likelihood of real‑world exploitation remains unclear, but an attacker who gains knowledge of the webhook URL can trigger the flaw. The vulnerability is not listed in the CISA KEV catalog. Given its network‑based nature, systems exposed to the internet are most susceptible, and any workflow that can perform privileged actions may be abused.