CVE-2025-68949

Executive Summary

CVE-2025-68949 is a security vulnerability in n8n, an open-source workflow automation platform, affecting versions 1.36.0 through 2.1.x. The flaw resides in the Webhook node's IP whitelist validation, which performs partial string matching instead of exact IP comparison. This allows an attacker with a non-whitelisted IP address to bypass IP-based access controls if their IP address merely contains the configured whitelist entry as a substring. For example, if the whitelist contains 192.168.1.1, an attacker with IP 192.168.1.100 or 192.168.1.10 could bypass the restriction. Both IPv4 and IPv6 addresses are affected. The vulnerability has a CVSS score of 5.3 (Medium) and is fixed in version 2.2.0.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Users who install n8n via npm are affected if they are running a vulnerable version. The package is widely used in automation workflows, and the vulnerability could allow unauthorized access to webhook endpoints, potentially leading to data leakage or unauthorized workflow execution. It is critical to update to version 2.2.0 or later to mitigate this risk.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure may occur.
• Integrity (I): Low (L) – Limited data modification may be possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The vulnerability allows bypassing IP-based access controls, but exploitation requires the attacker's IP to contain the whitelisted IP as a substring, which may limit practical exploitability in some environments.

Deep Dive & Mechanics

The vulnerability exists in the Webhook node's IP whitelist validation logic. The code performs a substring match rather than an exact IP comparison. For example, if the whitelist contains 192.168.1.1, the validation checks if the incoming request's source IP contains the string 192.168.1.1 anywhere within it. This means an IP like 192.168.1.100 (which contains 192.168.1.1 as a substring) would be incorrectly accepted.

The flawed logic can be represented as:

if (requestIP.includes(whitelistedIP)) { allow; }

Instead of the correct:

if (requestIP === whitelistedIP) { allow; }

This affects both IPv4 and IPv6 addresses. For IPv6, a whitelisted IP like 2001:db8::1 could be bypassed by an IP like 2001:db8::10 or 2001:db8::100.

The vulnerability is present in n8n versions 1.36.0 to 2.1.x. It was fixed in version 2.2.0 by implementing exact IP matching.

Vulnerable vs. Patched Code

Vulnerable Code (n8n < 2.2.0):

// Vulnerable: substring matching
function isIPWhitelisted(requestIP, whitelist) {
    return whitelist.some(ip => requestIP.includes(ip));
}

Patched Code (n8n >= 2.2.0):

// Patched: exact IP matching
function isIPWhitelisted(requestIP, whitelist) {
    return whitelist.some(ip => requestIP === ip);
}

The fix ensures that only an exact match of the IP address is accepted, preventing substring-based bypasses.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target n8n instance running version 1.36.0 to 2.1.x with a Webhook node configured with an IP whitelist.
• An attacker-controlled IP address that contains the whitelisted IP as a substring.

Exploitation Steps:

1. Identify the whitelisted IP address (e.g., 192.168.1.1) through reconnaissance or error messages.
2. Obtain an IP address that contains the whitelisted IP as a substring (e.g., 192.168.1.100).
3. Send a request to the webhook endpoint from the attacker IP.
4. The vulnerable code will accept the request, bypassing the IP whitelist.

Example using curl:

curl -X POST http://target-n8n-instance/webhook/test-webhook \
  -H "Content-Type: application/json" \
  -d '{"data": "malicious"}'

If the attacker's IP is 192.168.1.100 and the whitelist contains 192.168.1.1, the request will be accepted.

Blue Team (Defender)

Detection:

• Monitor logs for webhook requests from IPs that are not in the exact whitelist but contain whitelisted IPs as substrings.
• Look for patterns where the source IP is similar to but not exactly matching the whitelisted IPs.

Mitigation:

• Immediately update n8n to version 2.2.0 or later.
• If immediate patching is not possible, implement additional network-level access controls (e.g., firewall rules) to restrict access to the webhook endpoints.
• Review webhook logs for any suspicious activity that may indicate exploitation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Incoming requests to n8n webhook endpoints from IPs that are substrings of whitelisted IPs.
  • Repeated failed authentication attempts followed by successful access from similar IPs.
• Log IOCs:
  • Log entries showing webhook access from IPs that are not in the exact whitelist but contain whitelisted IPs as substrings.
• System IOCs:
  • Unauthorized workflow executions or data modifications.

Detection Engineering

YARA Rule

rule CVE_2025_68949_n8n_IP_Whitelist_Bypass {
    meta:
        description = "Detects n8n versions vulnerable to CVE-2025-68949 IP whitelist bypass"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68949"
    strings:
        $vuln_code = /requestIP\.includes\(ip\)/ nocase
        $patched_code = /requestIP\s*===\s*ip/ nocase
    condition:
        $vuln_code and not $patched_code
}

Sigma Rule

title: CVE-2025-68949 - n8n Webhook IP Whitelist Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-68949 where an IP address containing a whitelisted IP as a substring is used to bypass access controls.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: n8n
detection:
    selection:
        source_ip|contains: 
            - "192.168.1.1"  # Example whitelisted IP
            - "10.0.0.1"     # Another example
    condition: selection
falsepositives:
    - Legitimate requests from IPs that happen to contain the whitelisted IP as a substring
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-68949 - n8n Webhook IP Whitelist Bypass Attempt"; flow:to_server; content:"/webhook/"; http_uri; pcre:"/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update n8n: Upgrade to version 2.2.0 or later. This is the only complete fix.
2. Apply Firewall Rules: If immediate patching is not possible, implement network-level access controls (e.g., firewall rules) to restrict access to webhook endpoints to only trusted IPs.
3. Review Logs: Check webhook access logs for any suspicious activity that may indicate exploitation.

Long-Term Measures:

• Implement defense-in-depth by using additional authentication mechanisms (e.g., API keys, OAuth) for webhook endpoints.
• Regularly update n8n and other dependencies to the latest versions.
• Conduct security audits of custom configurations and workflows.

Workarounds:

• If patching is delayed, consider disabling the Webhook node's IP whitelist feature and relying on network-level controls.
• Use a reverse proxy (e.g., Nginx) to enforce IP whitelisting at the network layer.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert