Executive Summary

This vulnerability in the n8n workflow automation platform's Webhook node occurred because the IP whitelist validation used partial string matching instead of exact IP comparison. This meant that an incoming request could be accepted if its source IP address contained the configured whitelist entry as a substring, allowing attackers with non-whitelisted IPs that partially matched trusted IP prefixes to bypass access restrictions. Both IPv4 and IPv6 addresses were affected. The issue was fixed in version 2.2.0 by replacing the flawed string matching with proper CIDR-based IP address matching, ensuring accurate and secure whitelist checks. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized users to bypass IP-based access controls on n8n Webhook nodes if their IP address partially matches a whitelisted IP prefix. This undermines the intended security boundary, potentially exposing webhook endpoints to unauthorized access. The impact is limited to a low confidentiality loss, with no effect on integrity or availability. Attackers do not require privileges or user interaction to exploit this issue, making it a network-based risk. Users relying solely on IP whitelisting for webhook security are at risk until they upgrade to version 2.2.0 or implement additional authentication measures. [3]

Useful 0 Not Useful 0

Detection Guidance

Detection involves identifying webhook requests originating from IP addresses that partially match but are not exactly in the configured IP whitelist. Since the vulnerability allows substring matching instead of exact IP matching, you can monitor incoming webhook requests and compare their source IPs against your whitelist entries to find any that should be blocked but are accepted. Commands to detect this could include network traffic inspection tools or logs analysis, for example using `tcpdump` or `grep` on webhook access logs to find IPs that partially match whitelist entries but are not exact matches. However, no specific commands are provided in the available resources. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading n8n to version 2.2.0 or later, where the IP whitelist validation is fixed to use proper CIDR-based matching instead of substring matching. If upgrading immediately is not possible, do not rely solely on IP whitelisting for webhook security. Instead, implement additional authentication methods such as shared secrets, HMAC signatures, or API keys. Also, avoid using short or prefix-based whitelist entries that could be exploited. Additionally, enforce IP filtering at the network layer using reverse proxies or firewalls to restrict access to trusted IPs. [3]

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized IP addresses to bypass IP-based access controls on the n8n Webhook node, potentially leading to unauthorized access to workflows. This undermines intended security boundaries and could result in exposure of sensitive data. While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, such unauthorized access risks could negatively impact compliance by failing to adequately protect personal or sensitive data as required by these regulations. Users are advised to implement additional authentication methods and network-layer IP filtering to mitigate risks until the fix is applied. [3]

Useful 0 Not Useful 0