Type Confusion Vulnerability in n8n's Send Email Node

CVE-2026-72766

What is CVE-2026-72766?

n8n versions prior to 1.123.67, 2.x prior to 2.31.5, and 2.32.x prior to 2.32.1 are impacted by a type confusion vulnerability in the Send Email node. This vulnerability arises due to the omission of strict type enforcement for message fields, where manipulated non-string inputs from a workflow expression can be misinterpreted by the Nodemailer library as file paths or URLs. Attackers can exploit this flaw to perform arbitrary local file disclosure and initiate server-side request forgery (SSRF). Successful exploitation necessitates an active workflow with an unauthenticated webhook and valid SMTP credentials in a configuration that allows untrusted data to be mapped directly into the email's text or HTML body.

References