NoSQL Injection Vulnerability in n8n Chat Memory Node
CVE-2026-103250

7HIGH

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
1 October 2026

What is CVE-2026-103250?

A NoSQL injection vulnerability exists in the MongoDB Chat Memory node of n8n, where the sessionId parameter is inadequately validated. This weakness enables unauthorized attackers to inject MongoDB query operators into the sessionId field, potentially allowing them access to conversation histories of different users. Furthermore, it can facilitate unauthorized write and delete operations, thereby compromising the integrity and confidentiality of user data.

Affected Version(s)

n8n 0 < 1.123.80

n8n 2.0.0 < 2.39.6

n8n 2.40.0 < 2.40.1

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-w2...
vendor-advisory
https://www.vulncheck.com/advisories/n8n-before-1.123.80-...
third-party-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

trap-bytes
.