The n8n Send Email node vulnerability arises from a type confusion issue where message fields were not enforced as strings. This allowed attackers to supply crafted non-string values via workflow expressions, which the underlying Nodemailer library could interpret as file paths or URLs. Consequently, this could lead to arbitrary local file read or server-side request forgery (SSRF) on the host running n8n. Successful exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured in the Send Email node, and untrusted input mapped directly into the text or HTML body fields. This configuration is not default in n8n. The vulnerability has been addressed in versions 1.123.67, 2.31.5, and 2.32.1. Until upgrading, administrators should audit workflows, restrict webhook access, and limit workflow editing permissions to trusted users.

An attacker can disclose local files on the n8n host or perform SSRF by exploiting the type confusion in the Send Email node when untrusted input is mapped directly into email body fields. Exploitation requires specific conditions including an active unauthenticated webhook workflow and valid SMTP credentials. This could lead to sensitive information disclosure from the host system. The vulnerability is rated high severity.

A fix is available in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If immediate upgrading is not possible, administrators should audit active workflows for Send Email nodes that map untrusted input into message fields and remove or restrict them. Additionally, restrict public webhook access at the network or reverse-proxy level to prevent unauthenticated access, and limit workflow creation and editing permissions to fully trusted users. These mitigations are temporary and do not fully remediate the risk.