CVE-2026-103250

Summary

The flaw is a NoSQL injection vulnerability in the MongoDB Chat Memory node of n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1, allowing unauthenticated attackers to access and manipulate conversation histories.

Exploitability

Exploitation is relatively easy as it requires supplying MongoDB query operators in the sessionId field. The attacker must have access to the endpoint.

Blast radius

If exploited, attackers can access and modify conversation histories of other users, leading to potential data breaches and unauthorized actions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to n8n version 1.123.80 or later, 2.39.6 or later, or 2.40.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.