GitGuardian researchers have uncovered a widespread security issue affecting n8n, a popular open-source workflow automation platform. By scanning public GitHub commits, they identified 4,576 unique API tokens associated with 1,255 hostnames. Of the 896 instances that were reachable during testing, 321 accepted at least one leaked token, meaning roughly 36% of reachable instances were vulnerable to authenticated access using exposed credentials.
The researchers demonstrated four practical attack techniques in a controlled environment, all requiring only standard HTTP requests and documented REST API functionality—no software vulnerability exploitation or specialized tools were needed. These methods allowed attackers to enumerate users and workflows, use stored credentials like an OpenAI API key without seeing its value, read sensitive data tables, and even exfiltrate raw credential values by configuring a workflow to send them to an external listener.
n8n's design makes it a high-value target: it connects databases, code repositories, cloud environments, AI services, and customer support platforms. A privileged token can expose workflow definitions, execution data, and hard-coded secrets. Older API keys often lack expiration dates, remaining valid until manually revoked. The researchers also found that hostnames frequently appear alongside tokens in commits, often in .env files or even Claude Code permission settings, making discovery trivial.
Real-world instances showed similar weaknesses, including one workflow that backed up its own definitions to a public GitHub repository with a hard-coded SSH key. Responsible disclosure efforts yielded limited responses: of seven organizations contacted, four did not respond, one paid a $1,200 bounty and revoked the credential, and one hosting provider acknowledged the issue. GitGuardian also disclosed findings to n8n, which acknowledged the reports but had not confirmed fixes at publication time.
The researchers emphasize that revoking a leaked token is only the first step. Organizations should review workflows, data access, and downstream credentials, and rotate connected credentials where exposure cannot be ruled out. With n8n's central role in integrations, a single leaked token can provide a path to source control, databases, cloud services, and customer data—making the blast radius far larger than the platform itself.
Source: The Hackers News