CVE-2025-68949

MEDIUM EPSS 16.5%

Published Jan 13, 20265mo ago · Modified Jun 17, 20262w ago

5.3 CVSS 3.1

Medium

Published Jan 13, 2026 5mo ago

Last Modified Jun 17, 2026 2w ago

Description

n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured whitelist entry as a substring. This issue affected instances where workflow editors relied on IP-based access controls to restrict webhook access. Both IPv4 and IPv6 addresses were impacted. An attacker with a non-whitelisted IP could bypass restrictions if their IP shared a partial prefix with a trusted address, undermining the intended security boundary. This vulnerability is fixed in 2.2.0.

CVSS Details

Base Score

5.3

Exploitability

3.9

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

16.5% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 2

CWE-134

CWE-284

Affected Products 1

Vendor	Product	Version	Range
n8n	n8n	*	≥1.36.0 – <2.2.0

References 4

github.com https://github.com/n8n-io/n8n/commit/11f8597d4ad69ea3b58941573997fdbc4de1fec5

Patch
github.com https://github.com/n8n-io/n8n/issues/23399

Issue TrackingPatch
github.com https://github.com/n8n-io/n8n/pull/23399

Issue TrackingPatch
github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-w96v-gf22-crwp

Vendor Advisory

Remediation

github.com https://github.com/n8n-io/n8n/commit/11f8597d4ad69ea3b58941573997fdbc4de1fec5

Patch
github.com https://github.com/n8n-io/n8n/issues/23399

Issue TrackingPatch
github.com https://github.com/n8n-io/n8n/pull/23399

Issue TrackingPatch