CVE-2025-68949

n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured whitelist entry as a substring. This issue affected instances where workflow editors relied on IP-based access controls to restrict webhook access. Both IPv4 and IPv6 addresses were impacted. An attacker with a non-whitelisted IP could bypass restrictions if their IP shared a partial prefix with a trusted address, undermining the intended security boundary. This vulnerability is fixed in 2.2.0.

An adversary identifies an internet-exposed n8n instance via Shodan or certificate transparency logs. The target organization whitelists 10.10.1.1 for webhook access to protect an AI agent workflow that queries an internal LLM and writes results to a database. The attacker controls 10.10.1.10 or any IP containing '10.10.1.1' as a substring — the partial string check passes. With a single crafted HTTP request, they trigger the full AI agent workflow: the LLM receives attacker-controlled input, processes it with production context, and the response is written to the database. No credentials, no brute force, no alert triggered.