CVE-2026-72766 is a type confusion vulnerability in the n8n Send Email node affecting versions prior to 1.123.67, 2.31.5, and 2.32.1. The vulnerability arises because the node does not enforce that message fields are strings. An attacker supplying a crafted non-string value via a workflow expression into the text or HTML body fields can cause the underlying Nodemailer library to interpret these values as file paths or URLs. This can lead to arbitrary local file disclosure and server-side request forgery (SSRF). Successful exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field, which is not the default configuration.

If exploited, this vulnerability can allow an attacker to disclose local files on the server or perform server-side request forgery (SSRF) via the Send Email node in n8n. However, exploitation requires a specific and non-default configuration, including an active workflow with an unauthenticated webhook and valid SMTP credentials. There are no known exploits in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input directly in the Send Email node's message fields, especially in workflows with unauthenticated webhooks and configured SMTP credentials. Review and restrict workflow configurations to prevent exposure of these conditions.