n8n CVE-2026-103258

Exploitation requires that an n8n workflow actually uses a SendGrid, Freshservice, or ServiceNow node, AND that a vulnerable lookup/filter parameter on that node is bound to untrusted external input (e.g. a webhook payload, form field, or other attacker-influenced upstream value) rather than a static value - this is the AT:P attack requirement. If the node parameters are hardcoded or sourced only from trusted data, the match-all widening cannot be triggered. No n8n account is needed (PR:N) and no user interaction is required (UI:N), but the specific node and data-binding configuration are the real limiting factors. Impact is bounded to bulk read exposure (contacts, tickets, directory entries) on the connected third-party service, not the n8n host itself.

This is a genuine data-exposure flaw but a moderate operational priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.9, driven largely by the scope-change (SC:H) and the 'attack requirement' (AT:P) acknowledging that exploitation is not possible against a default install - a workflow author must have configured a SendGrid, Freshservice, or ServiceNow node and bound a vulnerable parameter to untrusted external input (e.g. a webhook field). The actual confidentiality impact is only Low (VC:L): the bug widens a single-record lookup into a match-all query, leaking bulk records (contact lists, tickets, directory entries) but not full secrets, and there is no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the provided data, so there is no public exploit identified at time of analysis - exploitation potential is theoretical and conditional. No SSVC decision data was supplied. Net: a real injection/authorization-widening bug worth patching, but gated behind specific node usage and non-default data-binding, so not an emergency relative to its headline score. Note the input Tags include 'Authentication Bypass,' which conflicts with the CWE-943 query-injection nature of this flaw - treat the auth-bypass label as inaccurate.

An n8n workflow uses a SendGrid, Freshservice, or ServiceNow node whose lookup/filter parameter is populated from untrusted external input (such as an incoming webhook or form submission). An attacker supplies input containing query-literal breakout characters, escaping the intended single-record filter and turning it into a match-all query that returns the entire contact list, ticket queue, or directory. No authentication to n8n is required (PR:N), but the vulnerable node must be in use and bound to attacker-reachable input (AT:P); no public PoC is available.