CVE-2026-85170

MediumCVSS 6.5/10Last modified Oct 29, 2026

Description

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing the composer to read a local file accessible to the n8n process or fetch an internal URL (SSRF) and attach the result to the outgoing message.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n8n-io	n8n	< 1.123.73
n8n-io	n8n	>= 2.36.0, < 2.36.2
n8n-io	n8n	>= 2.0.0-rc.0, < 2.35.4

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-95ph-833c-4wrpMitigation, Vendor Advisory
https://www.vulncheck.com/advisories/n8n-before-1.123.73-local-file-read-and-ssrf-via-gmail-and-brevo-nodesThird Party Advisory

Timeline

Published: Sep 3, 2026
Last modified: Oct 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-851716.5n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nod CVE-2026-851726.4n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Fun CVE-2026-851734.3n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated us CVE-2026-851748.8SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timi CVE-2026-851758.8SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go),CVE-2026-851768.8DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file CVE-2026-851775.4CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated u CVE-2026-851787.7Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the reque CVE-2026-851798.5Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including CVE-2026-85188.8Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-851807.5Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloa CVE-2026-851819.8CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid