Recent research by GitGuardian has unveiled significant security risks arising from leaked n8n API tokens. Found in public GitHub commits, these tokens allow unauthorized access to sensitive data and credentials, posing a substantial threat to organizations utilizing the automation platform.
Scope of the Exposure
GitGuardian’s study identified 321 n8n instances that accepted leaked API tokens from a total of 896 reachable instances. This represents 36% of instances tested and about 26% of all hostnames found in the commits. The platform, used to integrate various internal systems, becomes a high-value target due to its capabilities to connect databases, AI services, and more.
Without exploiting software vulnerabilities, attackers could harness exposed tokens to access workflow definitions and stored credentials. These tokens provide a potential gateway to compromising sensitive workflows and data.
Why n8n Is a Target
The open-source nature and extensive integrations of n8n make it an attractive target for cyber threats. With over 100,000 instances visible on Shodan and numerous security advisories since 2026, the platform’s vulnerability to attacks is high. A specific CVE-2025-68613 vulnerability has already been exploited in the wild, demonstrating the risk.
n8n tokens, which are signed JSON Web Tokens, sometimes lack expiration dates, extending their validity indefinitely unless manually revoked. This oversight can leave organizations vulnerable to token-based attacks long after their initial exposure.
Techniques and Implications
In a controlled environment, GitGuardian replicated four attack techniques utilizing standard REST API functionality. These techniques revealed how attackers could enumerate users and workflows, use stored credentials, and even extract raw credential data.
Such capabilities illustrate the potential for significant data exposure and credential theft if stolen tokens fall into the wrong hands. The findings underscore the need for robust credential management and proactive security measures.
Mitigation and Future Considerations
Revoking exposed tokens is crucial, but organizations should also review workflow access and connected systems for unauthorized changes. Rotating credentials and strengthening security practices across integrated platforms can mitigate risks.
As automation platforms like n8n facilitate connections between critical systems, the potential blast radius of a security breach extends far beyond the platform itself. Organizations must remain vigilant in securing their integration points to safeguard against credential theft and data breaches.
