Executive brief
n8n is a low-code automation platform that allows users to create workflows by connecting different services including email systems like Gmail and Brevo. A vulnerability in these email nodes allows authenticated users to read local files from the n8n server or access internal URLs and attach them to outgoing emails, potentially exposing sensitive data or allowing attacks on internal systems.
Technical details
The Gmail (v1) and Brevo nodes fail to validate that message content is a string before passing it to the mail composer. An authenticated user can supply an expression that resolves to an object with a path or href property, which the composer then uses to read local files or fetch internal URLs via SSRF. This occurs in the workflow execution context and requires the attacker to have the ability to create or run workflows. The vulnerability is fixed in n8n versions 1.123.73, 2.35.4, and 2.36.2.
Affected products
- n8n n8n before 1.123.73, 2.35.4, and 2.36.2
Timeline
- 2026-08-19: disclosed: GitHub Security Advisory GHSA-95ph-833c-4wrp published
- 2026-09-03: advisory: CVE-2026-85170 published on NVD
- 2026-08-19: patched: Patches available in versions 1.123.73, 2.35.4, and 2.36.2