CVE-2026-103250
Deferred Deferred - Pending Action

NoSQL Injection in n8n Chat Memory Node

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: VulnCheck

Description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-103250
EUVD
EUVD-2026-90644

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.80 (exc)
n8n n8n From 2.0.0 (inc) to 2.39.6 (exc)
n8n n8n From 2.40.0 (inc) to 2.40.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NoSQL injection vulnerability in n8n versions before 1.123.80, 2.39.6, and 2.40.1. The MongoDB Chat Memory node fails to validate the sessionId parameter, allowing unauthenticated attackers to inject MongoDB query operators. This can lead to unauthorized access to other users' conversation histories and enable write or delete operations.

Detection Guidance

To detect this vulnerability, check if your n8n instance uses the MongoDB Chat Memory node with an unauthenticated Chat Trigger. Inspect network traffic for requests containing MongoDB query operators in the sessionId parameter. Look for unusual access patterns or unauthorized data modifications in MongoDB logs.

Impact Analysis

Unauthenticated attackers could access your private chat histories, modify or delete conversations, or perform unauthorized actions if you use affected n8n versions with MongoDB Chat Memory nodes and unauthenticated Chat Trigger nodes.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements for data confidentiality and integrity.

Mitigation Strategies

Upgrade n8n to versions 1.123.80, 2.39.6, or 2.40.1 or later. Enable authentication on Chat Trigger nodes. Restrict access to trusted users only. Consider switching to an alternative memory backend if possible. Monitor for suspicious activity in MongoDB logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart