CVE-2023-27564: n8n Information Disclosure vulnerability
The n8n package prior to 0.216.1 for Node.js allows Information Disclosure.
Published May 10, 2023 · Updated Nov 27, 2023
Affected packages
n8n
- Ecosystem
- npm
- Affected
- < 0.216.1
- Fixed in
- 0.216.1
- Check
npm ls n8n
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The n8n package prior to 0.216.1 for Node.js allows Information Disclosure.
Credited to MarkLee131.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-27564
- https://www.synacktiv.com/sites/default/files/2023-05/Synacktiv-N8N-Multiple-Vulnerabilities_0.pdf
- https://github.com/n8n-io/n8n/releases/tag/n8n%400.216.1
- https://security.netapp.com/advisory/ntap-20230622-0007/
- https://github.com/n8n-io/n8n/pull/5525
- https://github.com/n8n-io/n8n/commit/27adea70459329fc0dddabee69e10c9d1453835f
- https://github.com/advisories/GHSA-r9xw-p7wj-w792
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More n8n vulnerabilities
All n8n entriesCVE-2026-86073
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
medium5.9Sep 10, 2026CVE-2026-86074
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
medium5.9Sep 10, 2026CVE-2026-86075
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
high8.7Sep 10, 2026CVE-2026-86076
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
high8.7Sep 10, 2026CVE-2026-86077
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
medium6.3Sep 10, 2026CVE-2026-86078
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
medium6.0Sep 10, 2026