CVE-2026-103250

HIGHCVSS 8.1

Description

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.

Timeline

Published:October 1st, 2026 11:17 AM

Last modified:October 6th, 2026 1:16 AM

CVSS Scoring

CVSS v3: 8.1 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Weaknesses (CWE)

CWE-943

References & Reports

Advisories, patches, and third-party reports

https://github.com/n8n-io/n8n/security/advisories/GHSA-w24g-6454-7w7f
https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-nosql-injection-via-mongodb-chat-memory

Source: NIST NVD · Data may lag official sources by up to one minute