Description

Detects when an n8n workflow lets any other workflow on the instance call it, because its callerPolicy setting is any. Any user who can build a workflow on the instance can then run it through an Execute Workflow node, together with the credentials and the access to other systems it holds, whatever project or owner the calling workflow belongs to.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads the callerPolicy setting of each one, published or not, from the workflow itself rather than from its published version

• Leaves a workflow with no callerPolicy of its own unreported, since it then follows the instance default, which an API key cannot read

• Reports a vulnerability when callerPolicy is any, the value that lets every other workflow on the instance call this one