Description

Detects when a Webhook node in the published version of an n8n workflow does not authenticate its callers, because its Authentication option is None or a value n8n does not check, so the node starts the workflow for each request it accepts. Anyone who learns or guesses its production URL can then run the workflow with data of their choosing, and make it act with the credentials and the access to other systems its nodes hold.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published, skipping disabled nodes

• Reads the Authentication option of each Webhook node, an option left unset counting as None, the n8n default, and leaves a node unreported when that option is an expression in double braces, since its value is only known when n8n evaluates it

• Reports a vulnerability when the option is None or any value other than basicAuth, bearerAuth, headerAuth, jwtAuth or n8nOAuth2, even when the node also limits its callers with an IP allowlist, which the evidence then shows; a workflow whose listing omits the published version field, or whose published version has no node list, is recorded as unreadable rather than reported as clean