{"schema":"threatline.record/2","record":{"id":"GHSA-mx4r-96jx-v278","aliases":["GHSA-mx4r-96jx-v278"],"summary":"Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret","details":"## Impact\n\nThe Asana Trigger accepted a new webhook verification secret from any request carrying an `X-Hook-Secret` header. An unauthenticated attacker who knows the webhook URL could replace the secret, send forged Asana events that pass signature verification, and trigger the workflow with attacker-controlled data. Genuine Asana deliveries were rejected afterwards.\n\n## Patches\n\nThe issue has been fixed in n8n version 2.38.0 and 3.0.1. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict network-level access to the Asana Trigger webhook endpoint.\n- Deactivate Asana Trigger workflows until the instance is patched.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278","source_modified_at":"2026-10-28T08:48:49Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.38.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278","source_modified_at":"2026-10-28T08:48:49Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 3.0.1"}],"fixed_versions":[],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T08:48:49Z","modified_at":"2026-10-28T08:48:49Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T08:48:49Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T08:48:49Z","content_hash":"6ac41874e0148a35c0e3dd3f42118cf0f7b2562de2461510111beca756f82c2e"}}