CVE-2026-72766 n8n-io CVE debrief

Who should care

DevOps teams and security professionals managing n8n workflows, especially those with unauthenticated webhooks or exposed SMTP configurations, should prioritize patching and review their configurations to prevent potential exploitation. Security teams responsible for vulnerability management and monitoring should also be aware of this vulnerability and assess their n8n deployments for potential exposure. Additionally, operators and administrators of n8n instances should be vigilant for suspicious workflow activity and email node usage.

Technical summary

The Send Email node in n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contains a type confusion vulnerability. This vulnerability occurs because the node does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL. This allows for arbitrary local file disclosure and server-side request forgery (SSRF). The vulnerability is particularly concerning in environments with unauthenticated webhooks or exposed SMTP configurations.

Defensive priority

Organizations using n8n should prioritize patching to prevent potential arbitrary local file disclosure and server-side request forgery.

Recommended defensive actions

• Patch n8n installations to version 1.123.67, 2.31.5, or 2.32.1.
• Review and restrict workflow configurations to prevent unauthenticated webhooks with untrusted input.
• Verify SMTP credentials are properly secured.
• Monitor for suspicious workflow activity and email node usage.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-72766 record indicates a type confusion vulnerability in n8n's Send Email node, which could lead to arbitrary local file disclosure and server-side request forgery. Exploitation requires specific configurations and untrusted input. Defenders should verify affected n8n workflows, review email node usage, and monitor for suspicious activity. The vulnerability's impact is heightened in environments with unauthenticated webhooks and exposed SMTP configurations. Security teams should assess their n8n deployments for potential exposure and prioritize patching.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.