CVE-2025-68949 n8n has a Webhook Node IP Whitelist Bypass via Partial String Matching

Medium 5.3 Published 13 Jan 2026 Updated 13 Jan 2026

Attackers can bypass webhook IP whitelists in n8n due to partial string matching, allowing unauthorized access to restricted workflows.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-68949?

CVE-2025-68949 is a medium-severity authentication bypass vulnerability in N8n N8n, published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured whitelist entry as a substring. This issue affected instances where workflow editors relied on IP-based access controls to restrict webhook access. Both IPv4 and IPv6 addresses were impacted. An attacker with a non-whitelisted IP could bypass restrictions if their IP shared a partial prefix with a trusted address, undermining the intended security boundary. This vulnerability is fixed in 2.2.0.

Weakness: CWE-284, CWE-134

Which versions are affected by CVE-2025-68949?

2 open source packages ship an affected version, including n8n. It affects 1 product.

Package	Affected	Fixed in
`n8n` npm	From `1.36.0`	`2.2.0`
`n8n` npm	From `1.36.0`	`2.2.0`

Products include N8n N8n.

How do I fix CVE-2025-68949?

Upgrade n8n to 2.2.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-68949 being exploited?

There is no known exploitation of CVE-2025-68949 in the wild and no public exploit code.

All N8n N8n vulnerabilities

Sources

Also known as GHSA-w96v-gf22-crwp.