CVE-2026-72766: n8n before 1.123.67 Arbitrary File Read via Send Email Node

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-29
Weakness: CWE-843

Description

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.

Affected products

n8n-io n8n: before 1.123.67; from 2.0.0 before 2.31.5; 2.32.0 (and their updates) — fixed in 1.123.67, 2.31.5
n8n-io n8n: before 1.123.67 — fixed in 1.123.67

How to fix

Upgrade to a fixed version: n8n-io n8n 1.123.67, 2.31.5; n8n-io n8n 1.123.67. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-72766 or the next vulnerability affects your stack