n8n CVE-2026-72766

Three specific, non-default prerequisites must all be simultaneously present. First, an active n8n workflow must have a webhook trigger node configured without authentication, meaning the webhook endpoint accepts HTTP requests from unauthenticated callers with no credential check. Second, that same workflow must include a Send Email node with valid SMTP credentials already configured by an administrator. Third, the workflow logic must map attacker-controlled input from the webhook request payload directly into the text or HTML body field of the Send Email node without applying string coercion or sanitization at the expression evaluation layer. The vendor explicitly states this is not a default n8n configuration. Exploitation is limited by: the necessity for an n8n administrator to have deliberately constructed such a workflow, the requirement that working SMTP credentials be pre-configured on the node, and the lack of any automatic input type enforcement prior to this fix. The PR:N in the CVSS vector reflects that the webhook caller does not authenticate to n8n - however, the vulnerable configuration must have been created by an authenticated administrator, meaning the attack surface is bounded by operational choices made at setup time.

The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N) reflects a genuine network-reachable, unauthenticated attack path with high confidentiality impact, but the AT:P modifier explicitly signals that exploitation depends on a non-default configuration; the raw score should not drive patch prioritization in isolation. EPSS data was not included in the provided intelligence feed and cannot be assessed here. The vulnerability does not appear in the CISA KEV catalog, and no public proof-of-concept code has been identified at time of analysis, both of which reduce the near-term automated exploitation risk relative to the CVSS score. Practical risk is concentrated in organizations running n8n as a public-facing integration platform with user-contributed or loosely governed workflows that expose unauthenticated webhooks with pre-configured SMTP credentials - organizations with network-restricted n8n deployments or strict workflow creation controls face substantially lower real-world exposure. The VC:H is well-supported by the arbitrary local file disclosure finding; SC:L correctly captures the lateral SSRF reach to adjacent internal services. CVSS signals are internally consistent and the vendor advisory does not contradict the vector.

An attacker enumerates or discovers an n8n instance with a publicly accessible, unauthenticated webhook that triggers a workflow containing a Send Email node with SMTP credentials configured and untrusted HTTP body parameters mapped into the email body field. The attacker sends a crafted HTTP POST to the webhook URL with a payload containing a JavaScript-style object value specifying a sensitive local file path (such as /etc/passwd or an application secrets file) or an internal service URL instead of a string; n8n passes this unsanitized value to Nodemailer, which reads the referenced file or issues an internal HTTP request and includes the result in the outgoing email sent to the attacker-controlled address. No public proof-of-concept code has been identified at time of analysis, but the technique is conceptually straightforward for an attacker familiar with Nodemailer's content object model once a vulnerable workflow configuration is identified.