🟠 High | Source: The Hacker News
GitGuardian researchers discovered 4,576 n8n API tokens exposed in public GitHub commits, with 321 live instances confirmed vulnerable to exploitation. Attackers could use these tokens to access workflow data, exfiltrate downstream credentials stored within n8n, and pivot to connected third-party services — all without exploiting any software vulnerability. The risk stems entirely from poor secrets hygiene rather than a flaw in n8n itself.
Security Architect’s Take: Audit your organisation’s GitHub repositories immediately for exposed n8n API tokens using a secrets scanning tool such as GitGuardian or Trufflehog, and enforce pre-commit hooks or CI/CD pipeline checks to prevent future leakage. Rotate any exposed tokens, restrict n8n API access to known IP ranges, and review stored credentials within n8n workflows for blast radius assessment.
Original advisory: Leaked n8n API Tokens Exposed Live Instances to Credential Theft