CVE-2026-72766

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.67 n8n versions 2.x prior to 2.31.5 n8n versions 2.32.x prior to 2.32.1

Description A type confusion issue exists in the Send Email node because message fields are not strictly enforced as strings. If a crafted non-string value is provided via a workflow expression into the text or HTML body fields, the underlying mail library (Nodemailer) may interpret it as a file path or URL. This can lead to arbitrary local file disclosure and server-side request forgery (SSRF), which is a technique used to induce the server to make requests to an unintended location. Exploitation requires a specific non-default configuration: an active workflow with an unauthenticated webhook, valid SMTP credentials, and untrusted input mapped directly to the body field.

Recommendations Update to version 1.123.67 or later. Update to version 2.31.5 or later for the 2.x branch. Update to version 2.32.1 or later for the 2.32.x branch.