CVE-2026-72766

Katalog CVE

CVSS 7.5 · High EPSS 0,44%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada n8n. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

28 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-2x35-3fw4-9jr4 advisory vendor · mitigasi
• https://www.vulncheck.com/advisories/n8n-before-arbitrary-file-read-via-send-email-node advisory pihak ketiga