MediumWebhook accepts unauthenticated requests
Anyone who learns the webhook URL can trigger this workflow with arbitrary data.
Confidence: medium · Heuristic
Suggested fix: Enable header or basic auth on the Webhook node, or verify a signature from the sending service.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: high · Heuristic · Uses incoming request data
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
LowUser-influenced URL path in HTTP request
The request host is fixed, but part of the path/query is built from data that can originate from a public entry point. Path injection is possible; full SSRF is not.
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
