CVE-2025-68949

n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured whitelist entry as a substring. This issue affected instances where workflow editors relied on IP-based access controls to restrict webhook access. Both IPv4 and IPv6 addresses were impacted. An attacker with a non-whitelisted IP could bypass restrictions if their IP shared a partial prefix with a trusted address, undermining the intended security boundary. This vulnerability is fixed in 2.2.0.

• CWE-134
• CWE-284

• https://github.com/n8n-io/n8n/commit/11f8597d4ad69ea3b58941573997fdbc4de1fec5Patch
• https://github.com/n8n-io/n8n/issues/23399Issue Tracking, Patch
• https://github.com/n8n-io/n8n/pull/23399Issue Tracking, Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-w96v-gf22-crwpVendor Advisory

Published

Jan 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68943Gitea before 1.21.8 inadvertently discloses users' login tim…5.3
• CVE-2025-68944Gitea before 1.22.2 sometimes mishandles the propagation of …5.3
• CVE-2025-68945In Gitea before 1.21.2, an anonymous user can visit a privat…5.3
• CVE-2025-68946In Gitea before 1.20.1, a forbidden URL scheme such as javas…5.4
• CVE-2025-68947NSecsoft 'NSecKrnl' is a Windows driver that allows a local,…5.7
• CVE-2025-68948SiYuan is self-hosted, open source personal knowledge manage…8.1
• CVE-2025-6895The Melapress Login Security plugin for WordPress is vulnera…9.8
• CVE-2025-68950ImageMagick is free and open-source software used for editin…6.2
• CVE-2025-68951phpMyFAQ is an open source FAQ web application. Versions 4.0…6.1
• CVE-2025-68952Eigent is a multi-agent Workforce. In version 0.0.60, a 1-cl…9.8
• CVE-2025-68953Frappe is a full-stack web application framework. Versions 1…7.5
• CVE-2025-68954Pterodactyl is a free, open-source game server management pa…5.4