CVE-2026-72766 Overview
CVE-2026-72766 is a type confusion vulnerability [CWE-843] in the n8n workflow automation platform. The flaw resides in the Send Email node, which fails to enforce string types on message body fields. Attackers can supply a crafted non-string value through a workflow expression to the text or HTML body field. The underlying Nodemailer library then interprets the value as a file path or URL. This behavior enables arbitrary local file disclosure and server-side request forgery (SSRF) against internal resources.
Affected releases include n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1.
Critical Impact
Attackers can read arbitrary local files and issue SSRF requests from the n8n server when an active workflow exposes an unauthenticated webhook that maps untrusted input into an SMTP-configured Send Email node.
Affected Products
- n8n versions prior to 1.123.67
- n8n 2.x versions prior to 2.31.5
- n8n 2.32.x versions prior to 2.32.1
Discovery Timeline
- 2026-08-11 - CVE-2026-72766 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72766
Vulnerability Analysis
The Send Email node in n8n passes user-controlled values from workflow expressions directly to Nodemailer without enforcing that message body fields are strings. Nodemailer supports polymorphic input for the text and html fields, accepting objects that reference a path or url. When such an object reaches the mail library, Nodemailer reads the referenced local file or fetches the remote URL and inserts the retrieved content into the outgoing message body. An attacker who controls the input can therefore exfiltrate arbitrary files or trigger internal HTTP requests from the n8n host. The retrieved data is delivered to the SMTP recipient, giving the attacker a reliable read primitive.
Root Cause
The root cause is missing type validation on the text and html parameters of the Send Email node. The node accepts arbitrary JavaScript values produced by workflow expressions and forwards them to Nodemailer without coercion or schema enforcement. Nodemailer treats object inputs containing path or href keys as instructions to load external content, a documented library behavior that becomes a security boundary violation when combined with untrusted input.
Attack Vector
Exploitation requires a specific chain of preconditions. The target n8n instance must have an active workflow containing an unauthenticated webhook trigger. The workflow must include a Send Email node with valid SMTP credentials configured. The workflow must map untrusted webhook input directly into the email body field.
When these conditions align, an attacker sends a webhook request containing a JSON object such as {"path": "/etc/passwd"} where a string body value is expected. Nodemailer reads the file, embeds its contents in the email, and delivers it to the SMTP recipient controlled by the attacker. Substituting url in place of path triggers SSRF against internal services reachable from the n8n server.
This is not a default configuration. See the GitHub Security Advisory and the VulnCheck Advisory for full technical detail.
Detection Methods for CVE-2026-72766
Indicators of Compromise
- Outbound SMTP messages containing contents of sensitive local files such as /etc/passwd, .env, or credential stores.
- Webhook request payloads containing JSON objects with path or url keys mapped to email body fields.
- Unexpected outbound HTTP requests originating from the n8n process to internal or metadata endpoints such as 169.254.169.254.
Detection Strategies
- Inspect n8n execution logs for Send Email node invocations where body field inputs are non-string types.
- Monitor webhook trigger inputs for structured payloads that deviate from expected string schemas.
- Correlate SMTP send events with file access on sensitive paths on the n8n host.
Monitoring Recommendations
- Enable egress filtering and log all outbound HTTP and SMTP traffic from n8n hosts.
- Alert on n8n process reads of files outside its expected working directories.
- Track version banners and package manifests to identify hosts running vulnerable n8n releases.
How to Mitigate CVE-2026-72766
Immediate Actions Required
- Upgrade n8n to 1.123.67, 2.31.5, or 2.32.1 or later depending on your release branch.
- Audit all active workflows for unauthenticated webhook triggers that feed input into Send Email nodes.
- Rotate any SMTP credentials that may have been used by exploited workflows.
Patch Information
The n8n maintainers released fixed versions 1.123.67, 2.31.5, and 2.32.1. The patch enforces string typing on the text and html fields of the Send Email node, preventing Nodemailer from interpreting object inputs as file paths or URLs. Refer to the GitHub Security Advisory GHSA-2x35-3fw4-9jr4 for release notes.
Workarounds
- Add authentication to all webhook triggers used by workflows that include a Send Email node.
- Sanitize webhook input in an intermediate Function node that coerces body values to strings before mapping into the Send Email node.
- Restrict egress from the n8n host to only approved SMTP relays and block access to internal metadata endpoints.
# Upgrade n8n via npm to a patched release
npm install -g n8n@1.123.67
# Or for the 2.x branch
npm install -g n8n@2.31.5
# Or for the 2.32.x branch
npm install -g n8n@2.32.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
