GitGuardian found 4,576 leaked n8n tokens, and a third of reachable instances accepted them

GitGuardian reported on August 5, 2026 that it found 4,576 unique n8n API tokens exposed in public GitHub commits across 1,255 hostnames, frequently sitting next to the instance URL in the same config file. Of 896 reachable instances tested, 321 accepted at least one leaked token, about 36 percent. In a controlled environment researchers demonstrated four paths: enumerate users, workflow definitions, and hard-coded secrets through read-only calls; invoke stored credentials such as OpenAI keys without ever reading their values; dump data tables of names, emails, and form responses; and build a workflow that ships stored credentials to attacker infrastructure in HTTP headers. n8n said it was aware and planned to address the issues.

Why it matters

Automation platforms are credential concentrators. n8n exists to hold connections to databases, source repositories, cloud accounts, AI services, and support tools, so a single API key for the orchestrator is worth more than any one of the credentials it stores. The fourth attack path is the one to internalize: the platform does not need to expose a secret's value for an attacker to steal it, because the attacker can simply build a workflow that uses the credential to call their own endpoint. Read-only access to a workflow engine is not read-only in effect. Treat orchestrator tokens as non-human identities with owners, expiry, and scoped permissions, keep them out of the repository entirely, and rotate every connected service credential if a token ever leaked.

Source: The Hacker News