CVE-2026-103258

Published 1 October 2026 · tracked since 2 October 2026

Description

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameters t

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-103686 LOW 3.5
• CVE-2026-102504 HIGH 7.5
• CVE-2026-103067 HIGH 8
• CVE-2026-94250
• CVE-2026-94269
• CVE-2026-94276
• CVE-2026-94212
• CVE-2026-94220
• CVE-2026-82806
• CVE-2026-88789 HIGH 8.6

→ Open the live CVE board · all tools