Act nowDisclosed

Advisory · CVE-2026-103250

Strangers could read your n8n chat histories via NoSQL injection

n8n's MongoDB Chat Memory node passed an unvalidated sessionId straight into a MongoDB query, letting unauthenticated callers read other users' conversation histories and perform unauthorized writes and deletes.

Advisory published October 1, 2026Independent summary
Vendor
n8n
Product
n8n
Identifier / CWE
CVE-2026-103250
CWE-943
Action timing
Immediate
ELI5

Explain it like I’m five

The chat app asked 'which conversation is yours?' and believed whatever answer it got. A stranger could answer with a trick question that matched everyone's conversations and read them all.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Public chat exposed

    A workflow pairs a Chat Trigger node configured with no authentication and a MongoDB Chat Memory node, giving the public a direct line into the memory backend.

  2. 02Operator injected

    The unauthenticated caller supplies a MongoDB query operator in the sessionId field of the chat request body instead of a plain string.

  3. 03Validation skipped

    The node passes the value into the MongoDB query that loads conversation history without validating that it is a plain string.

  4. 04Other sessions matched

    The database matches sessions other than the caller's, exposing other users' conversation histories. The same query path serves write and delete operations, so those are exposed too.

What happened

n8n’s security advisory GHSA-w24g-6454-7w7f describes a NoSQL injection flaw (CWE-943) in the MongoDB Chat Memory node. The node accepted the sessionId value from the Chat Trigger request body without validating that it was a plain string before passing it to the MongoDB query that loads conversation history. An unauthenticated caller could supply a MongoDB query operator in place of a session identifier, causing the database to match sessions other than their own.

That let an outside visitor with access only to the public chat URL read conversation histories belonging to other users. The same query path is used for write and delete operations, so unauthorized modification and deletion were exposed by the same defect. The issue affects workflows combining an unauthenticated Chat Trigger with a MongoDB Chat Memory node in n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. It is fixed in 1.123.80, 2.39.6, and 2.40.1.

What to do

  1. Upgrade to n8n 1.123.80, 2.39.6, or 2.40.1 or later, matching your release line.
  2. Until patched, enable authentication on any Chat Trigger nodes backed by a MongoDB Chat Memory node so the endpoint is no longer public.
  3. Alternatively, replace the MongoDB Chat Memory node with a different memory backend until the instance is patched.
  4. Audit chat and database logs for sessionId values containing query operators and for access to sessions outside expected patterns.
  5. Treat affected conversation histories as exposed and notify stakeholders where sensitive content may have been visible.

Management note

Any public-facing n8n chat backed by MongoDB memory was effectively a shared mailbox with no lock. The patch is the fix, but the log review decides whether this was a theoretical flaw or someone else’s reading material.