All vulnerabilities
CVE-2026-103258GHSA-5pg9-2vqx-r6jm

n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation

n8n-io n8nFrameworks
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.39.6Also 2.40.1CVE List
Published1 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameters to untrusted external input to widen single-record lookups into match-all queries, exposing bulk data including contact lists, tickets, and directory entries.

Text from CVE List

Affected versions 2

  • n8naffected: all versions before 2.39.6CVE List
  • n8naffected: 2.40.0 before 2.40.1CVE List

References 2