CVE-2025-68949: 
NixOS vulnerability analysis and mitigation

CVE-2025-68949 is an IP whitelist bypass vulnerability in the Webhook node of n8n, an open-source workflow automation platform. The flaw causes the IP whitelist validation to perform partial string matching instead of exact IP comparison, allowing unauthorized requests to pass through access controls. It affects n8n versions 1.36.0 through 2.1.x (before 2.2.0) for Node.js. The vulnerability was published on January 13, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause lies in the isIpWhitelisted function in packages/nodes-base/nodes/Webhook/utils.ts, which used JavaScript's String.includes() method to check whether a source IP matched a whitelist entry — meaning the check passed if the whitelist entry appeared anywhere as a substring of the incoming IP address (CWE-284: Improper Access Control; CWE-183: Permissive List of Allowed Inputs) (GitHub Advisory). For example, if 192.168.1.3 was whitelisted, a request from 192.168.1.30 would be incorrectly accepted because "192.168.1.30".includes("192.168.1.3") evaluates to true. The fix replaced this logic with Node.js's BlockList class for exact IP matching, as demonstrated in the patch commit (GitHub Commit, GitHub PR). Both IPv4 and IPv6 addresses were affected. No authentication or privileges are required to exploit this vulnerability over the network.

An attacker with a non-whitelisted IP address that shares a partial prefix with a trusted address can bypass IP-based access controls on n8n Webhook nodes, gaining unauthorized access to restricted workflows. This allows the attacker to trigger webhook-driven automation, potentially exposing sensitive data processed by those workflows or causing unintended actions to be executed. The confidentiality impact is rated low, with no direct integrity or availability impact, though the actual downstream consequences depend on what the triggered workflows perform (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of publication (Feedly). The vulnerability requires no authentication and is exploitable remotely with low attack complexity, but an attacker must know or guess a partial prefix of a whitelisted IP. The EPSS score is approximately 0.03% (0.000300), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify an internet-facing n8n instance running versions 1.36.0 through 2.1.x with Webhook nodes that have IP whitelisting configured. This can be done via Shodan, Censys, or similar tools searching for n8n web interfaces.
2. Identify whitelisted IPs: Attempt to determine the trusted IP addresses configured in the webhook's IP whitelist. This may be inferred from organizational network ranges, public documentation, or trial-and-error.
3. Craft a matching IP: Identify or obtain an IP address that contains the whitelisted IP as a substring. For example, if 10.0.0.1 is whitelisted, an attacker controlling 10.0.0.10 or 10.0.0.100 would pass the partial string check.
4. Send webhook request: Issue an HTTP request to the target n8n webhook endpoint from the crafted IP address. The flawed String.includes() check in isIpWhitelisted will evaluate the source IP as matching the whitelist entry.
5. Trigger restricted workflow: The webhook accepts the request and executes the associated workflow, potentially exposing data or triggering automated actions that were intended to be restricted (GitHub Advisory, GitHub PR).

• Network: Unexpected HTTP requests to n8n webhook endpoints originating from IP addresses that are not in the configured whitelist but share a numeric prefix with a trusted address (e.g., 192.168.1.30 when 192.168.1.3 is whitelisted).
• Logs: n8n application logs showing webhook executions triggered from unexpected source IPs; review n8n execution history for webhook-triggered workflows initiated by unfamiliar IP addresses.
• Application: Unexpected workflow executions in the n8n execution log, particularly for workflows with IP-restricted webhooks, that cannot be attributed to known authorized sources.

Upgrade n8n to version 2.2.0 or later, which replaces the flawed partial string matching with Node.js's BlockList-based exact IP comparison (GitHub Advisory, GitHub Commit). For users unable to upgrade immediately, the following workarounds are recommended:

• Add authentication mechanisms to webhooks such as shared secrets, HMAC signatures, or API keys.
• Avoid using short or prefix-ambiguous IP addresses in whitelist entries.
• Enforce IP filtering at the network layer using reverse proxies or firewalls rather than relying solely on n8n's application-level whitelist.

The vulnerability was reported by security researcher berkdedekarginoglu and disclosed via GitHub's security advisory process on January 13, 2026 (GitHub Advisory). The fix was developed by n8n contributor mfsiega and merged into the main branch on December 22, 2025, prior to the public advisory. Community discussion in the pull request focused on the technical approach of switching to Node.js's BlockList for exact IP matching. No significant broader media coverage or notable social media reactions have been identified beyond standard vulnerability aggregator coverage.