CVE-2026-72766
Received Received - Intake

Type Confusion in n8n Email Node Leading to SSRF

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72766
EUVD
EUVD-2026-56145

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.67 (exc)
n8n n8n From 2.31.5 (inc) to 2.32.1 (exc)
n8n n8n From 2.32.0 (inc) to 2.32.1 (exc)
nodemailer nodemailer *
n8n n8n to 2.31.5 (exc)
n8n n8n to 2.32.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a type confusion issue in n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1. The Send Email node does not enforce that message fields must be strings, allowing crafted non-string values to be misinterpreted as file paths or URLs by the underlying Nodemailer library. This can lead to arbitrary local file disclosure and server-side request forgery (SSRF).

Detection Guidance

Check n8n version with 'n8n --version' or 'docker exec <container> n8n --version'. Inspect active workflows for Send Email nodes mapping untrusted input into message fields. Review webhook configurations for unauthenticated access and verify SMTP credential storage.

Impact Analysis

An attacker could exploit this to read sensitive files on the n8n server or make unauthorized requests to internal systems. This requires an active workflow with an unauthenticated webhook, valid SMTP credentials, and untrusted input mapped into the email body fields. The impact includes potential data breaches and unauthorized access to internal resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, and non-compliance with regulatory obligations for protecting personal or health information.

Mitigation Strategies

Upgrade n8n to versions 1.123.67, 2.31.5, or 2.32.1 or later. Audit and remove workflows with Send Email nodes using untrusted input in message fields. Restrict public webhook access via network rules or reverse proxy. Limit workflow creation permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart