CVE-2025-68949 n8n has a Webhook Node IP Whitelist Bypass via Partial String Matching

n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured...

n8n: Webhook Node IP Whitelist Bypass via Partial String Matching

Impact The Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured whitelist entry as a substring. This issue affected instances where...

GHSA-W96V-GF22-CRWP n8n: Webhook Node IP Whitelist Bypass via Partial String Matching

Impact The Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured whitelist entry as a substring. This issue affected instances where...

PT-2026-2559

n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured...

Permissive List of Allowed Inputs

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the Webhook Node's IP whitelist validation due to includes method performing partial string matching instead of exact IP comparison. An attacker can gain...

CVE-2024-53861 Issuer field partial matches allowed in pyjwt

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for "abc". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. Since st...