MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook, Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumWebhook accepts unauthenticated requests
Anyone who learns the webhook URL can trigger this workflow with arbitrary data.
Confidence: medium · Heuristic
Suggested fix: Enable header or basic auth on the Webhook node, or verify a signature from the sending service.
MediumWebhook accepts unauthenticated requests
Anyone who learns the webhook URL can trigger this workflow with arbitrary data.
Confidence: medium · Heuristic
Suggested fix: Enable header or basic auth on the Webhook node, or verify a signature from the sending service.
