Description

Detects when an MCP Server Trigger node in the published version of an n8n workflow does not authenticate its clients, because its Authentication option is None or a value n8n does not check, so any MCP client that reaches its URL can list the tools connected to it and call them. Anyone who learns or guesses that URL can then run those tools without an account on the instance, together with the credentials and the access to other systems they hold.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published, skipping disabled nodes

• Reads the Authentication option of each MCP Server Trigger node, an option left unset counting as None, the n8n default, and leaves a node unreported when that option is an expression in double braces, since its value is only known when n8n evaluates it

• Reports a vulnerability when the option is None or any value other than basicAuth, bearerAuth, headerAuth, jwtAuth or n8nOAuth2; a workflow whose listing omits the published version field, or whose published version has no node list, is recorded as unreadable rather than reported as clean