Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck

CVE-2026-103250n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory

High 8.1

In plain English

A high-severity security flaw in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.2%top 90.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	0 – before 1.123.802.0.0 – before 2.39.62.40.0 – before 2.40.1

Weakness: CWE-943 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

References

GitHub Security Advisory (GHSA-w24g-6454-7w7f) vendor-advisory
VulnCheck Advisory: n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory third-party-advisory