Leaked n8n API Tokens Exposed 321 Instances to Credential Theft

Discovery of Exposed n8n Instances

GitGuardian researchers identified 321 n8n instances that were vulnerable due to API tokens exposed in public GitHub commits. A scan of public GitHub commits revealed 4,576 unique credentials associated with 1,255 hostnames. Of the 896 reachable instances tested, 36% (321 instances) accepted at least one leaked token, granting authenticated access.

Attack Vector and Implications

Attackers can use these leaked tokens to access sensitive data and downstream credentials without exploiting any software vulnerabilities. The researchers demonstrated four practical attack techniques using only documented REST API functionality and standard HTTP requests. This method allows access to workflow definitions, execution data, and in some configurations, the extraction of underlying credential values.

Why n8n is a High-Value Target

n8n is an open-source, low-code workflow automation platform with extensive integrations, including databases, source code repositories, and cloud environments. Organizations use n8n to connect internal tools and orchestrate API integrations. The platform's ability to store and manage credentials for these integrations makes it a high-value target for attackers once an API token is compromised.

Credential Management in n8n

While n8n encrypts credentials at rest using a master secret (N8N_ENCRYPTION_KEY), these credentials must be decrypted during workflow execution. An attacker with sufficient API privileges from a leaked token can reference these credentials in new workflows, effectively making the n8n instance use them on the attacker's behalf to access connected services.