CVE-2026-103250CWE-943

CVE-2026-103250

High · published October 1, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
7.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L
EPSS
0.00201 · 9.4th percentile
Weakness
CWE-943 · Improper Neutralization of Special Elements in Data Query Logic
Published
2026-10-01T15:17Z
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-w24g-6454-7w7f · [email protected]https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-nosql-injection-via-mongodb-chat-memory · [email protected]
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 10:41Z
    n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
    cvelistv5