CVE-2026-103258: n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameters to untrusted external input to widen single-record lookups into match-all queries, exposing bulk data including contact lists, tickets, and directory entries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.39.6 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.40.1
Event History
Frequently Asked Questions
Which workflows are exposed to this issue?
Workflows are exposed when they use SendGrid, Freshservice, or ServiceNow nodes and bind vulnerable node parameters to untrusted external input. The issue can turn an intended single-record lookup into a match-all query.
What must an attacker be able to do to exploit it?
An attacker needs to influence external input that is bound to a vulnerable parameter in one of the affected nodes. They can use parameter interpolation to break out of query literals and bypass the intended filter.
What information could be exposed?
Successful exploitation can widen lookups to return bulk data. The described examples include contact lists, tickets, and directory entries.
Which versions should be remediated?
Upgrade n8n to 2.39.6 or later on the 2.39 release line, or to 2.40.1 or later on the 2.40 release line. Versions before 2.39.6 and version 2.40.0 are affected.