n8n: N8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion…
n8n
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Record
- CVE-2026-72766
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 11, 2026
- Source last modified
- October 24, 2026
Description
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.
Description quoted from the NVD record.
Who is affected
n8n is a platform for automating tasks by linking apps and services into workflows. This flaw affects n8n versions before 1.123.67, 2.x versions before 2.31.5, and 2.32.x versions before 2.32.1. The problem is in the Send Email building block, which can be tricked by crafted message content. An attacker could read files on the server or make the server send requests to other systems. It works only when an active workflow can be started by anyone without logging in, the email step has working email server login details, and outside input goes straight into the email body. This is not a default setup. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should check which version is in use, because this flaw affects several release lines of the product.
- Update n8n to a fixed version:
1.123.67for the 1.x line,2.31.5for 2.x versions before 2.32, or2.32.1for the 2.32.x line. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- Treat this as a priority if any of your n8n workflows can be started by anyone without logging in and send email.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.