THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-5m98-cgcr-xx3q (medium) — n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

[GHSA] GHSA-5m98-cgcr-xx3q (medium) — n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

medgithub_advisoriesPublished 2026-09-10

GHSA-5m98-cgcr-xx3q Severity: medium CVE: CVE-2026-86080

n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

## Impact

The GitHub Trigger generated a signing secret when it registered a webhook and verified `X-Hub-Signature-256` on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already exis

Indicators of compromise

CVE-2026-86080cve

Original source: https://github.com/advisories/GHSA-5m98-cgcr-xx3q