What’s Vulnerable › Vulnerabilities

CVE-2026-103258: n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-06
• Weakness: CWE-943

Description

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameters to untrusted external input to widen single-record lookups into match-all queries, exposing bulk data including contact lists, tickets, and directory entries.

Affected products

• n8n-io n8n: before 2.39.6; from 2.40.0 before 2.40.1 — fixed in 2.39.6, 2.40.1

How to fix

Upgrade to a fixed version: n8n-io n8n 2.39.6, 2.40.1. Check the vendor advisory for mitigations.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-5pg9-2vqx-r6jm
• https://www.vulncheck.com/advisories/n8n-before-2.39.6-and-2.40-x-before-2.40.1-filter-bypass-via-parameter-interpolation

Get alerted when CVE-2026-103258 or the next vulnerability affects your stack