CVE-2025-68949
📋 TL;DR
This vulnerability allows attackers to bypass IP whitelist restrictions in n8n's Webhook node by using IP addresses that contain whitelisted entries as substrings. It affects n8n instances from version 1.36.0 to before 2.2.0 where administrators rely on IP-based access controls to restrict webhook access. Both IPv4 and IPv6 addresses are impacted.
💻 Affected Systems
- n8n
📦 What is this software?
N8n by N8n
⚠️ Risk & Real-World Impact
Worst Case
Attackers could trigger unauthorized workflows, potentially leading to data exfiltration, system compromise, or business logic manipulation if webhooks execute sensitive operations.
Likely Case
Unauthorized webhook requests could trigger workflows, potentially causing data integrity issues, service disruption, or information disclosure depending on workflow functionality.
If Mitigated
With proper network segmentation and additional authentication layers, impact would be limited to failed unauthorized access attempts.
🎯 Exploit Status
Exploitation requires knowledge of whitelisted IP patterns and ability to spoof or obtain IP addresses containing those patterns as substrings.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.0
Vendor Advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-w96v-gf22-crwp
Restart Required: Yes
Instructions:
1. Backup your n8n instance and workflows. 2. Update n8n to version 2.2.0 or later using your package manager or deployment method. 3. Restart the n8n service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network-level IP filtering
allImplement IP filtering at the network level (firewall, load balancer, or reverse proxy) instead of relying on n8n's built-in whitelist.
Disable IP whitelisting and use authentication
allRemove IP whitelist configurations and implement webhook authentication via secrets or tokens.
🧯 If You Can't Patch
- Implement network-level IP filtering with exact match validation
- Add additional authentication mechanisms to webhook workflows
🔍 How to Verify
Check if Vulnerable:
Check if n8n version is between 1.36.0 and 2.1.x AND has IP whitelist configured for any Webhook nodes.Check Version:
n8n --versionVerify Fix Applied:
Verify n8n version is 2.2.0 or later and test that IP whitelist validation now performs exact IP matching.📡 Detection & Monitoring
Log Indicators:
- Webhook requests from IP addresses that contain whitelisted patterns as substrings but aren't exact matches
- Failed IP validation attempts in n8n logs
Network Indicators:
- Unusual webhook traffic patterns from unexpected IP ranges
SIEM Query:
source="n8n" AND ("webhook" OR "IP validation") AND ("bypass" OR "unauthorized")