Recent research has uncovered a significant security risk involving n8n, an open-source workflow automation platform. Analysts identified 321 n8n instances that accepted API tokens exposed in public GitHub commits, potentially granting unauthorized access to sensitive data and credentials without exploiting any software vulnerabilities.
In a comprehensive scan of public GitHub commits, researchers discovered 4,576 unique n8n API tokens linked to 1,255 hostnames. Of the 896 instances that were accessible during testing, 321 accepted at least one of these leaked tokens. This indicates that approximately 36% of the reachable instances, or about 26% of all identified hostnames, were vulnerable due to exposed credentials.
n8n is widely utilized to connect various internal tools, automate processes, and orchestrate API integrations across diverse technology stacks. The platform’s capabilities include linking databases, source code repositories, cloud environments, AI services, and customer support platforms. Consequently, a compromised n8n instance can serve as a gateway to a multitude of interconnected systems, amplifying the potential impact of unauthorized access.
To assess the severity of this issue, researchers conducted controlled experiments demonstrating four attack techniques that leveraged the exposed API tokens. These methods utilized standard REST API functionalities and HTTP requests, requiring no exploitation of software vulnerabilities or specialized tools. The findings underscore the ease with which attackers can exploit leaked credentials to infiltrate systems.
The prevalence of n8n instances is notable, with over 100,000 instances detectable via platforms like Shodan. Since January 2026, more than 50 security advisories have been issued for n8n, highlighting its attractiveness as a target for cyber threats. As of March 31, 2026, 58% of scanned instances were running versions affected by at least one known security advisory. Notably, vulnerabilities such as CVE-2025-68613, an expression injection flaw with a CVSS score of 9.9, have been actively exploited in the wild, as confirmed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Beyond software vulnerabilities, the exposure of API tokens presents a distinct risk. Even without exploiting known flaws, attackers can gain authenticated access to n8n instances through these leaked credentials. This access can lead to unauthorized retrieval of workflow definitions, execution data, and stored credentials, potentially compromising the entire system.
To mitigate these risks, organizations should implement robust credential management practices, including regular audits of public repositories for exposed tokens, prompt revocation of compromised credentials, and stringent access controls. Additionally, keeping n8n instances updated with the latest security patches is crucial to protect against both known vulnerabilities and potential exploits arising from credential exposure.
This situation underscores the critical importance of securing API tokens and other credentials. As automation platforms like n8n become integral to organizational workflows, ensuring their security is paramount to prevent unauthorized access and potential data breaches.
