Detections
Analytics

SCA: security update for n8n (GHSA-w96v-gf22-crwp)

medium Tenable Self-Hosted Container Security Plugin ID 436718

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP
 whitelist validation performed partial string matching instead of exact IP comparison. As a result, an
 incoming request could be accepted if the source IP address merely contained the configured whitelist
 entry as a substring. This issue affected instances where workflow editors relied on IP-based access
 controls to restrict webhook access. Both IPv4 and IPv6 addresses were impacted. An attacker with a non-
 whitelisted IP could bypass restrictions if their IP shared a partial prefix with a trusted address,
 undermining the intended security boundary. This vulnerability is fixed in 2.2.0. (CVE-2025-68949)

See Also

https://github.com/advisories/GHSA-w96v-gf22-crwp

Plugin Details

Severity: Medium

ID: 436718

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/13/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2025-68949

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/13/2026

Vulnerability Publication Date: 1/13/2026

Reference Information

CVE: CVE-2025-68949