Local File Read and SSRF in n8n by n8n-io

CVE-2026-85170

What is CVE-2026-85170?

n8n versions prior to 1.123.73, 2.35.4, and 2.36.2 are susceptible to a vulnerability that allows authenticated users to exploit the Gmail and Brevo nodes. By submitting an expression that resolves to an object with a path or href property, users can manipulate the mail composer to read local files accessible to the n8n process or to send requests to internal URLs. This could lead to unauthorized file exposure or server-side request forgery, endangering the integrity of sensitive internal data and services.

References