The vulnerability in n8n affects specific nodes (SendGrid, Freshservice, and ServiceNow) where unescaped parameter interpolation allows attackers to manipulate query logic. By binding vulnerable node parameters to untrusted external input, attackers can bypass intended filters and convert single-record lookups into match-all queries, leading to unauthorized exposure of bulk data. The issue is present in versions before 2.39.6 and in 2.40.0 before 2.40.1. The CVSS 4.0 base score is 6.9, indicating a medium severity level. The vulnerability is published and a patch is available. The product is a cloud service, so remediation is typically managed by the vendor.

Exploitation of this vulnerability can lead to unauthorized data exposure by bypassing query filters, allowing attackers to retrieve bulk data from contact lists, tickets, and directory entries. This can result in significant information disclosure but does not indicate direct system compromise or privilege escalation.

A patch is available for this vulnerability. Users should upgrade n8n to version 2.39.6 or later, or to 2.40.1 or later to remediate this issue. Since n8n is a cloud-hosted service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory for confirmation of patch deployment status.