CVE-2026-118679: n8n SSRF — HIGH

CISO Take

n8n's Slack Trigger webhook has a server-side request forgery flaw (CVE-2026-118679, CVSS 7.5). An unauthenticated attacker who knows the webhook URL can make the node send the workspace's Slack access token to an attacker-controlled host. This works only when no signing secret is configured, because signature verification is then bypassed. Exploitation is not currently a priority: the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and no EPSS score is available yet. Attack complexity is rated high because the attacker needs the webhook URL and a trigger with no signing secret. The blast radius is still real, since a stolen Slack token can expose messages, files and channels, and n8n instances often hold many other credentials. Upgrade to n8n 1.123.83, 2.41.4 or 2.42.1 or later. Set a Slack signing secret on every Slack Trigger node, and rotate Slack tokens used by any trigger that ran without one.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Medium-high. The CVSS vector is network-reachable, needs no privileges or user interaction, and has a changed scope with high confidentiality impact. High attack complexity lowers likelihood: the attacker must learn the webhook URL and the target must have no signing secret. There is no KEV listing, public exploit or scanner template, and EPSS is unavailable, so there is no sign of active exploitation yet. Exposure is highest for internet-facing n8n instances used as AI agent orchestrators, where the Slack token often carries broad read/write scopes. Webhook URLs can leak through logs, shared workflow exports, browser history or Slack message links. Impact is limited to confidentiality of the Slack token, with minor integrity impact.

How does the attack unfold?

Reconnaissance

Attacker obtains the Slack Trigger webhook URL and confirms no signing secret is configured.

AML.T0006

Exploitation

Attacker sends an unsigned request naming a file to download, and the n8n node makes an outbound request to the attacker's host.

AML.T0049

Credential Theft

The node sends the Slack workspace access token to the attacker's host and returns the response.

AML.T0106

Impact

Attacker uses the stolen token to read Slack data, impersonate bots and manipulate AI agents that watch Slack channels.

AML.T0091.000

Reconnaissance

Attacker obtains the Slack Trigger webhook URL and confirms no signing secret is configured.

AML.T0006

Exploitation

Attacker sends an unsigned request naming a file to download, and the n8n node makes an outbound request to the attacker's host.

AML.T0049

Credential Theft

The node sends the Slack workspace access token to the attacker's host and returns the response.

AML.T0106

Impact

Attacker uses the stolen token to read Slack data, impersonate bots and manipulate AI agents that watch Slack channels.

AML.T0091.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SChanged

CHigh

ILow

ANone

What should I do?

1 step

1) Upgrade n8n to 1.123.83, 2.41.4 or 2.42.1 or later, depending on your release line. 2) Configure the Slack signing secret on every Slack Trigger node and credential, so signature verification is enforced. 3) Rotate Slack bot and user tokens for workspaces that used Slack Trigger without a signing secret, and review Slack audit logs for unusual API activity from unfamiliar IPs. 4) Restrict network exposure of n8n webhook endpoints with a reverse proxy, IP allowlisting for Slack's ranges, or a WAF. 5) Apply egress filtering on the n8n host so it can reach only approved destinations, which blocks token delivery to attacker hosts and limits SSRF to internal services. 6) Detection: look in n8n and proxy logs for Slack Trigger webhook requests that carry file or URL parameters pointing to external hosts, and for outbound requests from n8n to unknown domains. 7) Reduce Slack token scopes to the minimum required.

How is it classified?

Data LeakageAuth BypassAgentPluginFrameworkAML.T0025- Exfiltration via Cyber Means AML.T0049- Exploit Public-Facing Application AML.T0091.000- Application Access Token AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are followed

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-118679?

n8n's Slack Trigger webhook has a server-side request forgery flaw (CVE-2026-118679, CVSS 7.5). An unauthenticated attacker who knows the webhook URL can make the node send the workspace's Slack access token to an attacker-controlled host. This works only when no signing secret is configured, because signature verification is then bypassed. Exploitation is not currently a priority: the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and no EPSS score is available yet. Attack complexity is rated high because the attacker needs the webhook URL and a trigger with no signing secret. The blast radius is still real, since a stolen Slack token can expose messages, files and channels, and n8n instances often hold many other credentials. Upgrade to n8n 1.123.83, 2.41.4 or 2.42.1 or later. Set a Slack signing secret on every Slack Trigger node, and rotate Slack tokens used by any trigger that ran without one.

Is CVE-2026-118679 actively exploited?

No confirmed active exploitation of CVE-2026-118679 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118679?

1) Upgrade n8n to 1.123.83, 2.41.4 or 2.42.1 or later, depending on your release line. 2) Configure the Slack signing secret on every Slack Trigger node and credential, so signature verification is enforced. 3) Rotate Slack bot and user tokens for workspaces that used Slack Trigger without a signing secret, and review Slack audit logs for unusual API activity from unfamiliar IPs. 4) Restrict network exposure of n8n webhook endpoints with a reverse proxy, IP allowlisting for Slack's ranges, or a WAF. 5) Apply egress filtering on the n8n host so it can reach only approved destinations, which blocks token delivery to attacker hosts and limits SSRF to internal services. 6) Detection: look in n8n and proxy logs for Slack Trigger webhook requests that carry file or URL parameters pointing to external hosts, and for outbound requests from n8n to unknown domains. 7) Reduce Slack token scopes to the minimum required.

What systems are affected by CVE-2026-118679?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM-powered chatbots and ChatOps integrations, webhook-triggered AI pipelines.

What is the CVSS score for CVE-2026-118679?

CVE-2026-118679 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsLLM-powered chatbots and ChatOps integrationswebhook-triggered AI pipelines

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0049Exploit Public-Facing Application

AML.T0091.000Application Access Token

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.

Exploitation Scenario

An attacker finds a Slack Trigger webhook URL for an organization's n8n instance, for example from a leaked workflow export, public repository or exposed log. They confirm that the trigger has no signing secret, so unsigned requests are accepted. They then send a crafted request that names a file to download from a host they control. The node fetches the file from that host and includes the Slack workspace access token in the request. The attacker captures the token and gets the response back. With the token they read private channels, pull files and conversation history, and impersonate the AI agent's Slack bot. They can also use the bot's channel access to feed malicious prompts to downstream LLM agents.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.