What is CVE-2026-72766?
CVE-2026-72766 is a type confusion vulnerability in the Send Email node of n8n, an open-source workflow automation platform. The node does not enforce that its message fields hold string values, so a non-string value arriving from a workflow expression can be passed through to the underlying mail library, Nodemailer, which interprets it as a file path or a URL rather than message text.
The vulnerability carries a CVSS v3.1 base score of 7.5 (High). Under CVSS v4.0 it scores 8.2 (High). The difference reflects the attack requirements captured in the newer scoring model, which accounts for the deployment conditions exploitation depends on.
Exploitation does not require authentication to the n8n instance itself, but it does require a specific configuration to already be in place. Three conditions must hold: an active workflow exposing an unauthenticated webhook, valid SMTP credentials configured on the Send Email node, and untrusted input mapped directly into the text or html body field. n8n states this is not a default configuration.
Where those conditions are met, an attacker who can reach the webhook controls what the mail library receives. That yields disclosure of local files on the n8n host and server-side request forgery, with requests originating from inside the network segment where n8n runs. The practical value of the file read is high because n8n instances commonly hold configuration files, environment variables, and stored credentials for the systems they automate.
What assets are affected by CVE-2026-72766?
The vulnerability affects n8n versions before 1.123.67, 2.x versions before 2.31.5, and 2.32.x versions before 2.32.1. The flaw sits in the Send Email node, which ships as part of the standard node set rather than as an optional community extension, so any self-hosted deployment on an unpatched version carries the vulnerable code path.
In practice, an affected asset is a self-hosted n8n instance reachable over HTTP or HTTPS, frequently on TCP/5678, the platform’s default port. Deployments show up behind dedicated hostnames, on cloud provider IP ranges, and on container platforms. Many are stood up quickly to automate a specific business process and then left running, which is why they surface on the external attack surface at all.
The exposure pattern reflects how n8n is used. It sits between systems, holding credentials for the tools it connects, which makes a file read on the host disproportionately valuable compared to the same flaw in a single-purpose application. Instances that were deployed for an experiment, a proof of concept, or a departmental workflow are the ones most likely to have unauthenticated webhooks active and least likely to be on a patch schedule.
What does our data show about exposure patterns?
Exposure in this set is led by Consumer Staples at 20.5% of observed assets, with Information Technology contributing 15.1% and Consumer Discretionary 12.3%.
Consumer Staples organizations run distributed operations across manufacturing, distribution, and regional sales entities, each with its own marketing and logistics workflows. That structure produces exactly the conditions n8n is adopted to solve, and it produces them at the edges of the organization rather than at the center. Regional teams connect a form to a mailer to a spreadsheet, deploy it on infrastructure they control, and the resulting instance never enters the central inventory. The Information Technology share reflects a different path to the same outcome: engineering teams that adopt automation tooling early and run more instances per organization, including development and staging deployments that carry production credentials.
Across sectors, the common factor is not the software but the ownership gap. Assets in this set cluster in the parts of an organization furthest from central security review, appearing under subsidiary domains, on cloud accounts opened for a single project, and on hostnames that follow no naming convention. The distribution across a wide set of unclassified and smaller sectors, which together account for the majority of observed assets, reinforces the point. This is not an industry-specific problem. It is a visibility problem that appears wherever automation is adopted faster than it is inventoried.
Note that the observed assets are externally reachable n8n instances. Version confirmation is not established for every asset in the set, so these figures describe potential exposure rather than confirmed vulnerable deployments.
Are fixes available?
Patches are available. n8n addressed the issue in versions 1.123.67, 2.31.5, and 2.32.1. Organizations should upgrade to one of these releases or later, selecting the fixed version that matches their current release line.
The three-branch fix structure matters for remediation planning. An organization running the 2.31.x line should move to 2.31.5 rather than jumping to a 2.32.x release, and confirming which branch each instance runs on is a prerequisite to confirming it is patched. Instances that were deployed once and never updated may be several minor versions behind their branch head.
The vendor advisory was published on July 22, 2026, and the CVE record followed on August 11, 2026. Defenders should verify patch status directly against the n8n advisory and their own deployed version rather than relying on the presence of a CVE record in a scanning database, since coverage for recently published CVE identifiers varies across vulnerability data sources.
Are there any other recommended actions to take?
Until patching is confirmed, defenders should:
- Inventory all externally reachable n8n instances, including subsidiary and cloud-hosted deployments
- Audit active workflows for Send Email nodes fed by webhook data
- Restrict public webhook access at the reverse proxy or network layer
- Limit workflow creation and editing permissions to fully trusted users
- Monitor outbound connections from the n8n host for unexpected destinations
- Rotate SMTP credentials stored on any instance that was externally reachable
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for CVE-2026-72766 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
