Am I affected by n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes? What should I do?
n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
Affected: n8n before 2.25.7 and 2.26.0 to 2.26.1. Fixed in: 2.25.7. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-54308-n8n (opens external site)
1 answer
Am I affected? Affected: n8n before 2.25.7 and 2.26.0 to 2.26.1. Fixed in: 2.25.7.
- Check your version: run
npm ls n8n. Versions >= 2.26.0, < 2.26.2 of n8n are affected.
What to do now
- Upgrade to the fixed version: run
npm install n8n@2.26.2(first patched version 2.26.2). - Upgrade to n8n 2.25.7 or 2.26.2 or later.
- Deactivate any workflows using the Microsoft Agent 365 Trigger node or Stripe Trigger node until the instance can be upgraded.
- Restrict network access to the n8n webhook endpoint to trusted sources only.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-jvc7-762p-3743 (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-54308-n8n (opens external site)
Did this work for you?- Check your version: run