Incorrect Regular Expression in n8n - CVE-2025-68949
Published: January 13, 2026
Vulnerability identifier: #VU121206
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-68949
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass IP whitelisting.
The vulnerability exists due to application is using martial string matching instead of exact IP comparison when making a decision to allow access from a specific IP address. A remote attacker can bypass configured rules for whitelisted IP addresses and gain unauthorized access to the application. The vulnerability affects both Pv4 and IPv6 addresses.
Affected software
n8n
How to mitigate CVE-2025-68949
Install updates from vendor's website.
n8n - update to 2.2.0