AI Threat AlertCVE-2026-85170: n8n: local file read & SSRF via Gmail/Brevo nodes
HIGHAn authenticated n8n user who can run a workflow can craft an expression that resolves to an object with a path or href property instead of a plain string, tricking the Gmail (v1) and Brevo mail-composer nodes into reading a local file or fetching an internal URL and attaching the result to an outgoing email. There's no CVSS score, no EPSS data, no CISA KEV listing, no public exploit code, and no Nuclei template yet, so this isn't an internet-scanning-ready threat today — but n8n is a widely deployed AI workflow/agent orchestration platform with 211 other CVEs on record and a below-average OpenSSF Scorecard (6.7/10), signaling a pattern of input-validation gaps worth tracking. Because n8n workflows routinely hold credentials, service tokens, and internal API access, a malicious or compromised low-privilege workflow author could use this flaw to exfiltrate secrets from the host filesystem or probe internal-only services (including cloud metadata endpoints) and mail the results out. Patch to n8n 1.123.73, 2.35.4, or 2.36.2 immediately, and in the interim restrict who can create/edit workflows using the Gmail or Brevo nodes and review egress rules from the n8n host. Audit existing workflows for expression-based message content and monitor outbound mail from the n8n service account for unexpected attachments.
What is the risk?
Moderate risk. Exploitation requires an authenticated account with workflow-execution privileges, which limits it to insider threats or attackers who've already gained a foothold (e.g., via a compromised n8n credential) — this is not a pre-auth, internet-facing bug. No CVSS/EPSS scoring, no CISA KEV listing, and no public PoC or Nuclei template exist, so near-term mass exploitation is unlikely. However, the impact class (arbitrary local file disclosure plus SSRF) is high-value in an automation platform that typically runs with broad network reach and stores credentials for many connected services, and the package's track record (211 prior CVEs, 6.7/10 Scorecard) suggests this is not an isolated hardening gap.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 step1) Patch immediately to n8n 1.123.73, 2.35.4, or 2.36.2 per GHSA-95ph-833c-4wrp. 2) Until patched, restrict or review who has permission to create/edit workflows using the Gmail or Brevo nodes, since exploitation requires an authenticated workflow author. 3) Apply least-privilege to the n8n process's filesystem access and block egress from the n8n host to internal-only ranges and cloud metadata endpoints (e.g., 169.254.169.254) as defense in depth against SSRF. 4) Audit existing workflows for expressions feeding Gmail/Brevo message-content fields from untrusted or user-controlled data sources. 5) Monitor outbound email from the n8n sending account for unexpected or unusually large attachments as a detection signal.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-85170?
An authenticated n8n user who can run a workflow can craft an expression that resolves to an object with a path or href property instead of a plain string, tricking the Gmail (v1) and Brevo mail-composer nodes into reading a local file or fetching an internal URL and attaching the result to an outgoing email. There's no CVSS score, no EPSS data, no CISA KEV listing, no public exploit code, and no Nuclei template yet, so this isn't an internet-scanning-ready threat today — but n8n is a widely deployed AI workflow/agent orchestration platform with 211 other CVEs on record and a below-average OpenSSF Scorecard (6.7/10), signaling a pattern of input-validation gaps worth tracking. Because n8n workflows routinely hold credentials, service tokens, and internal API access, a malicious or compromised low-privilege workflow author could use this flaw to exfiltrate secrets from the host filesystem or probe internal-only services (including cloud metadata endpoints) and mail the results out. Patch to n8n 1.123.73, 2.35.4, or 2.36.2 immediately, and in the interim restrict who can create/edit workflows using the Gmail or Brevo nodes and review egress rules from the n8n host. Audit existing workflows for expression-based message content and monitor outbound mail from the n8n service account for unexpected attachments.
Is CVE-2026-85170 actively exploited?
No confirmed active exploitation of CVE-2026-85170 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-85170?
1) Patch immediately to n8n 1.123.73, 2.35.4, or 2.36.2 per GHSA-95ph-833c-4wrp. 2) Until patched, restrict or review who has permission to create/edit workflows using the Gmail or Brevo nodes, since exploitation requires an authenticated workflow author. 3) Apply least-privilege to the n8n process's filesystem access and block egress from the n8n host to internal-only ranges and cloud metadata endpoints (e.g., 169.254.169.254) as defense in depth against SSRF. 4) Audit existing workflows for expressions feeding Gmail/Brevo message-content fields from untrusted or user-controlled data sources. 5) Monitor outbound email from the n8n sending account for unexpected or unusually large attachments as a detection signal.
What systems are affected by CVE-2026-85170?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.
What is the CVSS score for CVE-2026-85170?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0037Data from Local SystemAML.T0053AI Agent Tool InvocationAML.T0086Exfiltration via AI Agent Tool InvocationCompliance Controls Affected
What are the technical details?
Original Advisory
n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing the composer to read a local file accessible to the n8n process or fetch an internal URL (SSRF) and attach the result to the outgoing message.
Exploitation Scenario
A contractor or low-privilege employee with workflow-editing access in a shared n8n instance builds (or modifies) a workflow that uses the Gmail or Brevo node to send a notification email. Instead of supplying a plain string for the message body, they set an expression that resolves to an object like `{ path: "/etc/passwd" }` or, more damagingly, `{ path: "/opt/n8n/.n8n/config" }` to pull local credentials, or `{ href: "http://169.254.169.254/latest/meta-data/iam/security-credentials/" }` to reach cloud instance metadata. When the workflow executes, n8n's mail composer reads the local file or fetches the internal URL and attaches the result to the outgoing email, which is addressed to (or forwarded to) the attacker — exfiltrating sensitive host data or cloud credentials without needing any additional foothold.
Weaknesses (CWE)
CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- [Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
- [Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-274959.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8n