AI Threat AlertCVE-2026-126382: n8n: Asana Trigger webhook secret reset enables forged events
MEDIUMn8n before 2.38.0 and 3.x before 3.0.1 lets anyone who knows an Asana Trigger webhook URL overwrite its verification secret by sending an X-Hook-Secret header, with no authentication required (CWE-306). Once the secret is replaced, the attacker can send forged Asana events that pass signature checks and start workflows with attacker-controlled data, while genuine Asana deliveries are rejected. Severity is medium (CVSS 5.4, high attack complexity because the webhook URL must be known), and there is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so mass exploitation looks unlikely today. The risk is higher where n8n workflows tied to Asana feed AI agents or have write access to downstream systems, since forged input can steer those automations. Upgrade to 2.38.0 or 3.0.1, treat Asana webhook URLs as secrets, and review execution logs for unexpected Asana-triggered runs.
What is the risk?
Medium overall. The flaw is network-reachable and needs no privileges or user interaction, but high attack complexity applies because the attacker must learn the webhook URL. There is no known exploitation, public exploit, KEV listing or scanner template, and EPSS is unavailable. The scope is marked changed because forged events reach downstream workflows and systems beyond the trigger node. Confidentiality is unaffected, while integrity and availability take limited impact: forged data is injected and legitimate events are rejected. Risk grows where workflows trigger privileged actions or feed LLM agents.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n to 2.38.0 or later on the 2.x line, or to 3.0.1 or later on the 3.x line. 2) Until patched, restrict access to n8n webhook endpoints with a reverse proxy, IP allowlisting (Asana's source ranges) or a WAF rule that drops requests with an X-Hook-Secret header from non-Asana sources. 3) Treat webhook URLs as secrets and rotate them, then re-register the Asana webhook, for any workflow that may have been exposed. 4) Review execution history and access logs for Asana Trigger runs that do not match real Asana activity, and for failed legitimate deliveries. 5) Add input validation and human approval before forged-prone workflow outputs reach AI agents or write-capable tools. 6) Alert on Asana webhook handshake requests outside the expected registration time.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-126382?
n8n before 2.38.0 and 3.x before 3.0.1 lets anyone who knows an Asana Trigger webhook URL overwrite its verification secret by sending an X-Hook-Secret header, with no authentication required (CWE-306). Once the secret is replaced, the attacker can send forged Asana events that pass signature checks and start workflows with attacker-controlled data, while genuine Asana deliveries are rejected. Severity is medium (CVSS 5.4, high attack complexity because the webhook URL must be known), and there is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so mass exploitation looks unlikely today. The risk is higher where n8n workflows tied to Asana feed AI agents or have write access to downstream systems, since forged input can steer those automations. Upgrade to 2.38.0 or 3.0.1, treat Asana webhook URLs as secrets, and review execution logs for unexpected Asana-triggered runs.
Is CVE-2026-126382 actively exploited?
No confirmed active exploitation of CVE-2026-126382 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-126382?
1) Upgrade n8n to 2.38.0 or later on the 2.x line, or to 3.0.1 or later on the 3.x line. 2) Until patched, restrict access to n8n webhook endpoints with a reverse proxy, IP allowlisting (Asana's source ranges) or a WAF rule that drops requests with an X-Hook-Secret header from non-Asana sources. 3) Treat webhook URLs as secrets and rotate them, then re-register the Asana webhook, for any workflow that may have been exposed. 4) Review execution history and access logs for Asana Trigger runs that do not match real Asana activity, and for failed legitimate deliveries. 5) Add input validation and human approval before forged-prone workflow outputs reach AI agents or write-capable tools. 6) Alert on Asana webhook handshake requests outside the expected registration time.
What systems are affected by CVE-2026-126382?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, webhook-triggered pipelines, LLM agent orchestration.
What is the CVSS score for CVE-2026-126382?
CVE-2026-126382 has a CVSS v3.1 base score of 5.4 (MEDIUM).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0093Prompt Infiltration via Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accepts a new webhook verification secret from any request carrying an X-Hook-Secret header. Unauthenticated attackers who know the webhook URL can replace the secret, send forged Asana events that pass signature verification, and trigger workflows with attacker-controlled data while genuine deliveries are rejected.
Exploitation Scenario
An attacker finds an n8n Asana Trigger webhook URL through leaked logs, a shared repository, browser history or a misconfigured proxy. They send an unauthenticated POST with an X-Hook-Secret header, and n8n stores their value as the new webhook secret. The attacker then signs forged Asana events with that secret and sends them, which launches the workflow with crafted task data. If the workflow passes task text to an LLM agent that can create tickets, send messages or call internal APIs, the attacker uses the forged content for prompt injection and unauthorized actions, while real Asana events fail verification and the team does not notice.
Weaknesses (CWE)
CWE-306Missing Authentication for Critical FunctionalityPrimaryCWE-306Missing Authentication for Critical FunctionalityCWE-306 — Missing Authentication for Critical Functionality: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- [Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:LReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n