Executive brief
n8n is a workflow automation platform that uses webhook nodes to receive incoming requests. The webhook node's IP whitelist security control checked for partial string matches instead of exact IP addresses, allowing attackers with non-whitelisted IPs to bypass access controls if their IP happened to contain a configured whitelist entry as a substring. This undermines organizations' ability to restrict webhook access to trusted networks.
Technical details
The vulnerability is a flawed input validation issue (CWE-183/CWE-284) in the Webhook node's IP whitelist mechanism. Instead of performing strict IP address comparison, the validation logic used substring matching, allowing requests from IPs that merely contained the whitelisted entry as a substring to be accepted. This affected both IPv4 and IPv6 addresses and required no authentication or user interaction, being exploitable directly via network access to the webhook endpoint. An attacker could craft an IP address that shares a partial prefix with a trusted whitelisted IP to bypass the intended access control boundary. The vulnerability was introduced in version 1.36.0 and patched in version 2.2.0 with corrected exact IP comparison logic.
Affected products
- n8n n8n 1.36.0 to 2.1.x
Timeline
- 2026-01-13: disclosed
- 2026-01-13: patched: Version 2.2.0