IP Whitelist Bypass Vulnerability in n8n: Partial String Matching Flaw
Summary
GHSA-w96v-gf22-crwp: n8n: Webhook Node IP Whitelist Bypass via Partial String Matching. Affects n8n versions >= 1.36.0, < 2.2.0. Fixed in 2.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services through customizable workflows. It provides a user-friendly interface for creating automated tasks and integrates with numerous APIs. However, the security of webhook access in n8n is compromised due to a flaw in its IP whitelist validation mechanism, which relies on partial string matching instead of exact IP comparisons.
Vulnerability Detail
The vulnerability arises from the Webhook node's IP whitelist validation process, which performs partial string matching. This means that an incoming request could be accepted if the source IP address contains the configured whitelist entry as a substring. This flaw affects both IPv4 and IPv6 addresses, allowing attackers with non-whitelisted IPs to bypass security restrictions if their IP shares a partial prefix with a trusted address. This undermines the intended security boundary and poses a risk to sensitive workflows relying on IP-based access controls.
How To Fix
Latest published version: 2.44.6 as of 22 Oct 2026
npm install n8n@2.44.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.0
This is the first release that contains the fix.
npm install n8n@2.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, users should implement the following workarounds: 1. Add authentication mechanisms such as shared secrets, HMAC signatures, or API keys to secure webhook access. 2. Avoid using short or prefix-based whitelist entries. 3. Enforce IP filtering at the network layer using reverse proxies or firewalls.
Conclusion
The IP whitelist bypass vulnerability in n8n poses a significant risk to users relying on IP-based access controls for webhook security. It is crucial to upgrade to the patched version 2.2.0 or implement recommended workarounds to mitigate potential threats. Users can also utilize Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for n8n →
FAQ
The vulnerability is a flaw in the IP whitelist validation that allows partial string matching, enabling unauthorized access to webhooks.
If you are using n8n version 1.36.0 or later and rely on IP whitelisting for webhook security, your instance may be affected.
An attacker could exploit this vulnerability to gain unauthorized access to sensitive workflows, potentially leading to data breaches or unauthorized actions.
Yes, the vulnerability has been patched in version 2.2.0 of n8n. Users are advised to upgrade to this version or later.
Vulert is a tool that monitors and alerts users about open-source vulnerabilities in their software using the package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
