Description

Detects when a Form Trigger node in the published version of an n8n workflow does not authenticate who submits the form, because its Authentication option is None or a value n8n does not check, or its version has no such option. An unknown person can then feed the workflow the field values and, when the form has a file field, any file of their choosing, and make it act on them with the credentials and the access to other systems its nodes hold.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published, skipping disabled nodes

• Counts a Form Trigger node in version 1 as unauthenticated, since that version has no Authentication option

• Reads the Authentication option of each later Form Trigger node, an option left unset counting as None, the n8n default, and leaves a node unreported when that option is an expression in double braces, since its value is only known when n8n evaluates it

• Reports a vulnerability when the option is None or any value other than basicAuth, bearerAuth, headerAuth, jwtAuth or n8nUserAuth, even when the node also limits who reaches the form with an IP allowlist, which the evidence then shows, and notes in the evidence when the form accepts files; a workflow whose listing omits the published version field, or whose published version has no node list, is recorded as unreadable rather than reported as clean