SB2026011349 - IP whitelist bypass in n8n
Published: January 13, 2026
Security Bulletin ID
SB2026011349
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Incorrect Regular Expression (CVE-ID: CVE-2025-68949)
The vulnerability allows a remote attacker to bypass IP whitelisting.
The vulnerability exists due to application is using martial string matching instead of exact IP comparison when making a decision to allow access from a specific IP address. A remote attacker can bypass configured rules for whitelisted IP addresses and gain unauthorized access to the application. The vulnerability affects both Pv4 and IPv6 addresses.
Remediation
Install update from vendor's website.