AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature…? What should I do?

    The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery.

    Affected: n8n < 1.123.76, >= 2.0.0 < 2.37.7, >= 2.38.0 < 2.38.2. Fixed in: 1.123.76, 2.37.7, 2.38.2. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-86080-n8n (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: n8n < 1.123.76, >= 2.0.0 < 2.37.7, >= 2.38.0 < 2.38.2. Fixed in: 1.123.76, 2.37.7, 2.38.2.

      • Check your version: run npm ls n8n. Versions < 1.123.76 of n8n are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install n8n@1.123.76 (first patched version 1.123.76).
      2. Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2 or later to remediate the vulnerability.
      3. Deactivate and reactivate any GitHub Trigger workflows to force a fresh webhook registration with a new secret, provided the remote GitHub hook has been deleted first so that the 422 reuse path is not taken again.
      4. Restrict network access to the n8n webhook endpoint to GitHub's published IP ranges only.
      5. Audit GitHub Trigger workflow static data for entries that contain a webhookId but no webhookSecret, and treat those workflows as unprotected until reactivated successfully.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-86080-n8n (opens external site)

      Did this work for you?

    Add your answer or comment