PT-2026-103791
CVE-2026-103258
·
تاريخ النشر
2026-10-01
·
تاريخ التحديث
2026-10-06
الوصف من
CVSS 4.0
6.9
متوسطةالمقاييسAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
n8n versions prior to 2.39.6
n8n versions 2.40.0 through 2.40.0
Description
An unescaped parameter interpolation issue exists in the SendGrid, Freshservice, and ServiceNow nodes. This allows attackers to bypass filters by breaking out of query literals. By binding vulnerable node parameters to untrusted external input, an attacker can expand single-record lookups into match-all queries, potentially exposing bulk data such as contact lists, tickets, and directory entries.
Recommendations
Update n8n to version 2.39.6 or later.
Update n8n to version 2.40.1 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾