Leaked n8n API Tokens Exposed Live Instances to Credential Theft
GitGuardian identified 4,576 leaked n8n API tokens across 1,255 unique hostnames in public GitHub commits, with 321 instances (36% of reachable) still accepting those credentials Attackers can exploit leaked tokens through four documented REST API techniques without any CVE exploitation, accessing workflow definitions, stored credentials, and downstream secrets n8n API keys often lack expiration claims ("exp"), allowing tokens committed months earlier to remain valid indefinitely until manually
Analysis
TL;DR
- GitGuardian identified 4,576 leaked n8n API tokens across 1,255 unique hostnames in public GitHub commits, with 321 instances (36% of reachable) still accepting those credentials
- Attackers can exploit leaked tokens through four documented REST API techniques without any CVE exploitation, accessing workflow definitions, stored credentials, and downstream secrets
- n8n API keys often lack expiration claims ("exp"), allowing tokens committed months earlier to remain valid indefinitely until manually revoked
- 58% of scanned instances ran versions affected by known security advisories, including CVE-2025-68613 (CVSS 9.9) added to CISA's Known Exploited Vulnerabilities catalog
- The blast radius extends beyond n8n itself: compromised instances can expose databases, cloud environments, AI services, and internal systems connected through workflow integrations
Why It Matters
This research highlights a critical gap in credential hygiene for automation platforms that serve as central nervous systems for enterprise integrations. For AI practitioners and security teams, it demonstrates how leaked tokens—often overlooked compared to direct vulnerability exploitation—can provide authenticated access to sensitive data pipelines and downstream credentials without touching a single CVE.
Technical Details
- Scope: Scanned public GitHub commits since April 2025 for n8n API tokens; validated 896 reachable instances, confirmed 321 accepting leaked tokens; also tested 372 MCP (Model Context Protocol) tokens with 7 still valid (2%)
- Token Structure: n8n API keys are signed JWTs with
"aud": "public-api"claim; many lackexpexpiration fields, remaining valid until explicit revocation; n8n introduced 30-day default expiration only in version 1.78.0 (February 2025) - Attack Vectors: Four techniques reproduced using only documented REST API and standard HTTP requests—no specialized tooling or CVE exploitation required; validation via
curl -H "X-N8N-API-KEY: <token>" GET /api/v1/workflowsreturning 200 for valid tokens - Credential Storage: n8n encrypts stored credentials at rest using
N8N_ENCRYPTION_KEY, but decrypts them at runtime for workflow execution; attackers with API privileges can reference credentials in new workflows to make the instance use them on the attacker's behalf - Vulnerability Landscape: 58% of scanned instances ran versions with known security advisories; CVE-2025-68613 (expression injection, CVSS 9.9) enables sandbox escape and arbitrary filesystem read/write access
Industry Insight
- Organizations should audit all n8n instances for exposed API tokens in version control systems and implement automated token rotation policies; treat leaked credentials as actively exploitable even without vulnerability patching
- The n8n case illustrates a broader pattern: low-code automation platforms that centralize credentials become high-value targets where token leakage alone can compromise entire integration ecosystems—security teams should prioritize credential monitoring alongside vulnerability management
- AI agent platforms using Model Context Protocol (MCP) represent a newer exposure surface; the 2% validation rate for MCP tokens suggests similar hygiene gaps exist across emerging AI integration standards that warrant immediate scrutiny
Disclaimer: The above content is generated by AI and is for reference only.