Alex Joseph
n8n is a powerful open-source tool that helps you automate workflows and integrate various applications without writing extensive code. However, a significant security flaw has been identified in its ‘Send Email’ node, posing a risk to users. This vulnerability, tracked as CVE-2026-72766, could potentially expose sensitive information or allow malicious server requests if not addressed promptly.
CVE Details
This vulnerability affects the n8n automation platform.
- Product: n8n
- Published Date: August 11, 2026
- Severity: High
- Status: Analyzed
Affected Products
The issue specifically impacts the ‘Send Email’ node within certain versions of n8n. If you are running any of the following, your instance is vulnerable:
- n8n versions before 1.123.67
- n8n 2.x versions before 2.31.5
- n8n 2.32.x versions before 2.32.1
Both community and enterprise editions of n8n built for Node.js are affected.
Current Status
The vulnerability has been thoroughly analyzed by the n8n development team. Patches have been released, and users are strongly advised to update their installations to a secure version as soon as possible. The issue is well-understood, and clear solutions are available. The last modification to this vulnerability record was on October 23, 2026.
Severity Level
Rated with a CVSS score of 7.5, this vulnerability is classified as ‘High’ severity. This means that while exploiting it might require specific conditions, the potential impact is considerable. An attacker could leverage this flaw to disclose arbitrary local files from your server or perform Server-Side Request Forgery (SSRF). This could lead to sensitive data exposure or unauthorized access to internal network resources. It’s important to note that exploitation isn’t straightforward and requires specific configurations, such as an active workflow with an unauthenticated webhook, valid SMTP credentials, and direct mapping of untrusted input to the email body field.
Possible Solutions
The most effective way to protect your n8n instance from CVE-2026-72766 is to apply the available patches immediately.
Update Your n8n Instance
Upgrade to one of the following patched versions (or newer):
- n8n 1.123.67
- n8n 2.31.5
- n8n 2.32.1
These updates address the type confusion issue in the ‘Send Email’ node, ensuring that message fields are correctly enforced as strings, thereby preventing misinterpretation by the underlying mail library.
Mitigation Strategies
If an immediate update isn’t feasible, consider these temporary mitigation steps:
- Strict Input Validation: Avoid mapping untrusted or user-supplied input directly into the ‘text’ or ‘HTML body’ fields of the ‘Send Email’ node without rigorous validation.
- Secure Webhooks: Ensure that any webhooks associated with workflows containing the ‘Send Email’ node are authenticated, preventing unauthenticated access to potentially vulnerable workflows.
- Review SMTP Configuration: Be mindful of the SMTP credentials configured on your ‘Send Email’ nodes and limit their permissions where possible.
Regularly reviewing your n8n workflows for secure configurations is a crucial best practice.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-2×35-3fw4-9jr4
https://www.vulncheck.com/advisories/n8n-before-arbitrary-file-read-via-send-email-node
