The n8n Slack Trigger receives webhook events that may cause an automation or agent workflow to fetch files and perform actions. A missing optional signing secret creates an identity gap: a network caller can supply a message that resembles a Slack event without the trigger proving it came from Slack. Where downstream file retrieval uses the workflow’s…
Inspect the ClaimsCase · DiggingBeagle record
n8n Slack Trigger could accept unsigned requests when a signing secret was not configured
A Slack workflow trigger accepted unverified webhook content under an optional signing-secret configuration, potentially invoking downstream tools.
Scope
An n8n Slack Trigger workflow with signing verification absent and reachable event endpoint. Downstream token use depends on workflow configuration.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The security notice describes an optional-secret trust boundary and potential credential-backed downstream actions; no verified exploitation population is given. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-N8N-SLACK-UNSIGNED-WEBHOOK-1 · n8n Slack Trigger signature configuration and file retrieval advisory
At a glance
Successful event spoofing is not proof that every deployment fetched a private Slack file or sent its contents outside.
Read the implicationsExact affected versions and whether a permissive configuration was common need full advisory reconciliation. No verified production credential theft is established by the source.
Limits and uncertaintyFull account
The n8n Slack Trigger receives webhook events that may cause an automation or agent workflow to fetch files and perform actions. A missing optional signing secret creates an identity gap: a network caller can supply a message that resembles a Slack event without the trigger proving it came from Slack. Where downstream file retrieval uses the workflow’s configured Slack OAuth credential, attacker-controlled event fields may also influence what content is fetched under that authority.
The failure is conditional on how the trigger was configured; it does not mean every n8n Slack installation accepts unsigned internet traffic. No real theft is established merely by a proof of concept. A complete check must send a forged event and show the handler rejecting it before any agent or credentialed tool is called. This case is distinct from other n8n Code node, vector-store and MCP plugin advisories already present in the catalog.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-N8N-SLACK-UNSIGNED-WEBHOOK-1The advisory describes an n8n Slack Trigger configuration in which absent request signing can allow forged events to reach credentialed workflow steps.supported
Basis: reported finding
- supportsn8n Slack Trigger signature configuration and file retrieval advisoryprimary disclosure
GitHub advisory, Slack signing-secret verification and OAuth-backed file handling
Implications
Successful event spoofing is not proof that every deployment fetched a private Slack file or sent its contents outside.
Controls and mitigations
- Require the Slack signing secret and validate the raw-body signature and timestamp; constrain downstream file and model tool access.
Unknowns and contradictions
- Exact affected versions and whether a permissive configuration was common need full advisory reconciliation.
- No verified production credential theft is established by the source.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208