CVE-2025-68949

Katalog CVE

CVSS 5.3 · Medium EPSS 0,30%

Kerentanan Use of Externally-Controlled Format String pada n8n. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured whitelist entry as a substring. This issue affected instances where workflow editors relied on IP-based access controls to restrict webhook access. Both IPv4 and IPv6 addresses were impacted. An attacker with a non-whitelisted IP could bypass restrictions if their IP shared a partial prefix with a trusted address, undermining the intended security boundary. This vulnerability is fixed in 2.2.0.

Rincian

Terbit di NVD

13 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-134: Use of Externally-Controlled Format String
CWE-284: Improper Access Control

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-w96v-gf22-crwp advisory vendor
• https://github.com/n8n-io/n8n/commit/11f8597d4ad69ea3b58941573997fdbc4de1fec5 patch
• https://github.com/n8n-io/n8n/issues/23399 issue tracking · patch
• https://github.com/n8n-io/n8n/pull/23399 issue tracking · patch