CVE-2026-103250: n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory

Q: Which deployments are exposed?

Deployments using the MongoDB Chat Memory node are affected if they run a version before 1.123.80, a 2.x version from 2.0.0 before 2.39.6, or a 2.40.x version before 2.40.1. The issue is specifically in handling the node's sessionId parameter.

Q: Does exploitation require an authenticated n8n user or user interaction?

No. The vulnerability can be exploited by unauthenticated attackers, and no user interaction is required. Exploitation requires supplying MongoDB query operators through the sessionId field.

Q: What could an attacker do through this issue?

An attacker may access conversation histories belonging to other users. They may also perform unauthorized write and delete operations through the affected MongoDB Chat Memory functionality.

Q: What versions should be used to remediate the issue?

Upgrade to version 1.123.80, 2.39.6, or 2.40.1, as appropriate for the deployed release line.

Published Oct 1, 2026

Updated

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.

Affected Software

1 affected component

n8n n8n<1.123.80, >=2.0.0<2.39.6, >=2.40.0<2.40.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade n8n to a version that resolves this vulnerability.
Fixed in 1.123.80
Upgrade
Upgrade n8n to a version that resolves this vulnerability.
Fixed in 2.39.6
Upgrade
Upgrade n8n to a version that resolves this vulnerability.
Fixed in 2.40.1

Event History

Oct 1, 2026

CVE Published

via MITRE·10:41 AM

Data Sourced

via MITRE·10:41 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using the MongoDB Chat Memory node are affected if they run a version before 1.123.80, a 2.x version from 2.0.0 before 2.39.6, or a 2.40.x version before 2.40.1. The issue is specifically in handling the node's sessionId parameter.

Does exploitation require an authenticated n8n user or user interaction?

No. The vulnerability can be exploited by unauthenticated attackers, and no user interaction is required. Exploitation requires supplying MongoDB query operators through the sessionId field.

What could an attacker do through this issue?

An attacker may access conversation histories belonging to other users. They may also perform unauthorized write and delete operations through the affected MongoDB Chat Memory functionality.

What versions should be used to remediate the issue?

Upgrade to version 1.123.80, 2.39.6, or 2.40.1, as appropriate for the deployed release line.

CVE-2026-103250: n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an authenticated n8n user or user interaction?

What could an attacker do through this issue?

What versions should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an authenticated n8n user or user interaction?

What could an attacker do through this issue?

What versions should be used to remediate the issue?