Threat Intelligence

Exposed n8n API Tokens Put Automation Workflows at Risk

The Hacker News · 5 Aug 2026

Key Takeaway Never store API tokens or credentials directly in code — use secure secrets management and regularly scan your repositories for accidental leaks.

Researchers at GitGuardian have uncovered thousands of exposed API tokens for n8n, a popular workflow automation platform, sitting in public GitHub commits. By scanning public repositories, the team found 4,576 unique credentials linked to 1,255 hostnames, and confirmed that 321 of these n8n instances were still live and would accept the leaked tokens.

Importantly, this isn't a case of hackers exploiting a software bug. The researchers showed that with a valid leaked token alone, an attacker could access sensitive data and even reach downstream credentials connected to the automation workflows, such as passwords or keys used to link n8n to other business systems. This means the risk comes entirely from how credentials are handled and stored, not from a flaw in n8n itself.

The findings highlight a common but often overlooked problem: developers accidentally committing API keys, tokens, or passwords into code repositories, where they can remain publicly visible indefinitely. For businesses using automation tools like n8n to connect apps, databases, or customer systems, a leaked token could give attackers a direct path into sensitive workflows and connected accounts.

API security credential leak n8n GitHub automation security

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.