MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumWebhook accepts unauthenticated requests
Anyone who learns the webhook URL can trigger this workflow with arbitrary data.
Confidence: medium · Heuristic
Suggested fix: Enable header or basic auth on the Webhook node, or verify a signature from the sending service.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: low · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: low · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
This relationship is inferred from references in the step settings, not from a real connection in the workflow.
Confidence: low · Heuristic · Via an inferred reference
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUnencrypted HTTP request
The request uses plain http://, so data and any credentials travel unencrypted.
Confidence: high · Definite match
Suggested fix: Use https:// if the service supports it.
