n8n: Unauthenticated Cross-Project Workflow Execution via Webhook Path-Only Resolution

Impact

A dynamic-path webhook URL contains a server-generated identifier that is the only unguessable part of it. Webhook resolution matched on the path alone and ran first, so a request omitting that identifier still resolved to the workflow and executed it. An unauthenticated caller can run a workflow in a project they have no relationship with, under that project's credentials. The same resolver serves the form and MCP routes. Node-level authentication still applies.

Patches

The issue has been fixed in n8n versions 1.123.83, 2.42.1 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Enable node-level webhook authentication (Basic, Header, or JWT) on all active Webhook nodes that use dynamic path templates.
• Deactivate workflows using dynamic-path webhooks until the instance is patched.
• Apply network-level controls to restrict access to the /webhook/*, /form/*, and /mcp/* routes to trusted sources only.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.