CVE-2026-103258

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.39.6 n8n versions 2.40.0 through 2.40.0

Description An unescaped parameter interpolation issue exists in the SendGrid, Freshservice, and ServiceNow nodes. This allows attackers to bypass filters by breaking out of query literals. By binding vulnerable node parameters to untrusted external input, an attacker can expand single-record lookups into match-all queries, potentially exposing bulk data such as contact lists, tickets, and directory entries.

Recommendations Update n8n to version 2.39.6 or later. Update n8n to version 2.40.1 or later.