CVE-2026-72766 in n8n
Summary
by MITRE • 08/11/2026
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability under discussion represents a critical type confusion issue affecting n8n versions prior to specific patch releases including 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1. This flaw exists within the Send Email node functionality where the system fails to properly validate that message fields contain string data types. The absence of strict type enforcement creates a dangerous condition where non-string values can be inadvertently processed by the underlying Nodemailer library, which interprets these inputs through a different execution path than intended. This misinterpretation enables attackers to manipulate the mail processing pipeline by injecting malicious payloads that bypass normal input validation mechanisms.
The technical exploitation of this vulnerability relies on the underlying mail library's handling of non-string inputs within message body fields. When a crafted value is passed as a text or HTML body field, the Nodemailer library may interpret this data as a file path or URL reference rather than plain text content. This misinterpretation creates multiple attack vectors including arbitrary local file disclosure where attackers can access sensitive files on the server filesystem and server-side request forgery attacks that allow unauthorized network requests to internal systems. The vulnerability specifically leverages the trust relationship between workflow execution and input processing, where untrusted user data flows directly into critical system functions without proper sanitization.
Operational impact assessment reveals that exploitation requires multiple specific conditions to be met, making this vulnerability less likely to be exploited in the wild but still highly concerning for affected deployments. The attack scenario necessitates a pre-existing active workflow with an unauthenticated webhook endpoint, valid SMTP credentials configured on the vulnerable node, and untrusted input directly mapped into the body field of the email node. This multi-factor requirement means that organizations must have already configured their n8n instances in ways that create exposure conditions, but when these conditions exist, the impact can be severe as attackers gain access to file systems and can potentially escalate privileges through SSRF capabilities. The vulnerability does not represent a default configuration issue, but rather an edge case that emerges from specific deployment patterns where workflow expressions interact directly with email sending functionality.
The mitigation strategy focuses on immediate version upgrades to patched releases including 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, which implement proper type validation for message fields within the Send Email node. Organizations should also implement strict input sanitization measures and review their workflow configurations to eliminate direct mapping of untrusted input into email body fields. Network segmentation and webhook access controls should be strengthened to limit exposure windows, while monitoring systems should be configured to detect unusual patterns in email processing activities that might indicate exploitation attempts. This vulnerability aligns with CWE-129 and CWE-707 categories related to improper input validation and type confusion issues, and maps to ATT&CK techniques involving privilege escalation through server-side request forgery and credential access through local file disclosure attacks. Regular security audits of workflow configurations and input handling processes should be implemented to prevent similar vulnerabilities from emerging in other components of the system architecture.