The vulnerability lies in the ZendeskTrigger node of n8n, where before versions 1.123.18 and 2.6.2 the node does not verify the HMAC‑SHA256 signature Zendesk attaches to webhook payloads. An attacker who knows the webhook endpoint can send unsigned POST requests, causing n8n to accept the payload and trigger the associated workflow. Workflows can invoke external services or downstream nodes, potentially inserting malicious data into the execution flow.

Any deployment of n8n version 1.x earlier than 1.123.18 or 2.x earlier than 2.6.2 exposes the ZendeskTrigger node to unsigned requests. The vulnerability exists in the n8n automation platform running on Node.js and is present in both the open‑source and enterprise editions that include the ZendeskTrigger node.

Based on the description, the CVSS base score of 6.3 signals moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation. The exploitation window is broad: anyone who can reach the public webhook URL can craft an unsigned payload without authentication. The vulnerability is not listed in the CISA KEV catalog, but the lack of signature verification makes it straightforward for an attacker to trigger any workflow. Based on the description, it is inferred that the attack vector is remote network and no local privileges are required. Based on the description, it is inferred that the exploit requires only knowledge of the URL, which may be disclosed in documentation or network traffic; once triggered, malicious data can be injected into the workflow.