CVE-2026-103250: n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.80 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.39.6 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.40.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the MongoDB Chat Memory node are affected if they run a version before 1.123.80, a 2.x version from 2.0.0 before 2.39.6, or a 2.40.x version before 2.40.1. The issue is specifically in handling the node's sessionId parameter.
Does exploitation require an authenticated n8n user or user interaction?
No. The vulnerability can be exploited by unauthenticated attackers, and no user interaction is required. Exploitation requires supplying MongoDB query operators through the sessionId field.
What could an attacker do through this issue?
An attacker may access conversation histories belonging to other users. They may also perform unauthorized write and delete operations through the affected MongoDB Chat Memory functionality.
What versions should be used to remediate the issue?
Upgrade to version 1.123.80, 2.39.6, or 2.40.1, as appropriate for the deployed release line.