PT-2026-2559 · N8N · N8N

Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-68949

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions n8n versions 1.36.0 through 2.1.9

Description n8n is a workflow automation platform where the Webhook node’s IP whitelist validation incorrectly used partial string matching instead of exact IP comparison. This allowed incoming requests to be accepted if the source IP address contained the configured whitelist entry as a substring. Both IPv4 and IPv6 addresses were impacted, potentially allowing an attacker with a non-whitelisted IP to bypass access restrictions if their IP shared a partial prefix with a trusted address. The issue affected instances relying on IP-based access controls to restrict webhook access.

Recommendations Update to version 2.2.0 or later.

Exploit

Fix

Improper Access Control

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-284

CWE-134

CWE-183

Related Identifiers

BDU:2026-00784

CVE-2025-68949

GHSA-W96V-GF22-CRWP

Affected Products

N8N

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68949.json · Exploit
• https://github.com/n8n-io/n8n/pull/23399 · Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-w96v-gf22-crwp · Vendor Advisory
• https://github.com/n8n-io/n8n/commit/11f8597d4ad69ea3b58941573997fdbc4de1fec5 · Patch
• https://github.com/n8n-io/n8n/issues/23399 · Patch
• https://osv.dev/vulnerability/CVE-2025-68949 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w96v-gf22-crwp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68949 · Security Note
• https://bdu.fstec.ru/vul/2026-00784 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/2011181491733320076 · Twitter Post