n8n: Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret

Impact

The Asana Trigger accepted a new webhook verification secret from any request carrying an X-Hook-Secret header. An unauthenticated attacker who knows the webhook URL could replace the secret, send forged Asana events that pass signature verification, and trigger the workflow with attacker-controlled data. Genuine Asana deliveries were rejected afterwards.

Patches

The issue has been fixed in n8n version 2.38.0 and 3.0.1. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict network-level access to the Asana Trigger webhook endpoint.
• Deactivate Asana Trigger workflows until the instance is patched.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.