---
id: CVE-2026-118679
title: >-
  n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack
  Trigger
summary: >-
  n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery
  vulnerability in the Slack Trigger webhook that allows unauthenticated
  attackers to exfiltrate Slack tokens by bypassing signature verification when
  no signin…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: n8n-io
product: n8n
affected:
  - n8n < 1.123.83
  - n8n >= 2.42.0 < 2.42.1
  - n8n >= 2.0.0 < 2.41.4
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T18:59:51.136Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118679'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-3c3p-5959-3ghr'
    label: GitHub Security Advisory (GHSA-3c3p-5959-3ghr)
  - url: >-
      https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-slack-token-exfiltration-via-slack-trigger
    label: >-
      VulnCheck Advisory: n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token
      Exfiltration via Slack Trigger
tags:
  - cve.org
epss: 0.00273
epssPercentile: 0.19723
ingestedAt: '2026-10-29T15:37:07.549Z'
---

## Overview

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.

## Affected

- `n8n < 1.123.83`
- `n8n >= 2.42.0 < 2.42.1`
- `n8n >= 2.0.0 < 2.41.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.