Leaked n8n API Tokens Exposed Live Instances to Credential Theft
GitGuardian researchers discovered 4,576 unique n8n API tokens exposed in public GitHub commits, associated with 1,255 hostnames. Of these, 321 live n8n instances were found accepting these leaked credentials. Attackers could leverage these tokens to access sensitive data and downstream credentials without exploiting any software vulnerabilities. The secrets remained exposed.
Severity: Critical · Category: Data Exfiltration
Impact: 321 n8n instances exposed to credential theft and sensitive data access.
Source: The Hacker News · Aug 05 2026 · Original source
What Happened
GitGuardian researchers identified 321 n8n instances that accepted API tokens exposed in public GitHub commits. These leaked credentials provided authenticated access to approximately 36% of the reachable instances tested, or roughly 26% of all hostnames identified in the commits. Attackers could leverage these tokens to access sensitive data and downstream credentials without needing to exploit any software vulnerabilities, using only documented REST API functionality and standard HTTP requests.
Timeline
- February 2025 — n8n version 1.78.0 introduced a 30-day default expiration for API keys.
- April 2025 — GitGuardian began collecting n8n API tokens identified in public GitHub commits.
- March 11, 2026 — CVE-2025-68613, an expression injection vulnerability with a CVSS score of 9.9, was added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, confirming exploitation in the wild.
- March 31, 2026 — 58% of the n8n instances scanned were running a version affected by at least one known security advisory.
- August 05, 2026 — The Hacker News published an article detailing GitGuardian's findings regarding leaked n8n API tokens.
Technical Analysis
The n8n API keys are signed JSON Web Tokens (JWTs) that record their issuance time in the `iat` claim. Many of the tokens discovered during the research lacked an `exp` claim, meaning they had no defined expiration date. While n8n introduced a 30-day default expiration in version 1.78.0 in February 2025, older tokens generated without this expiration could remain valid indefinitely until explicitly deleted or revoked. An n8n API key's validity also depends on its continued existence in the n8n database, not solely on its signature.
GitGuardian's research pipeline extracted 4,576 unique API tokens and 1,255 unique hostnames from 5,469 public GitHub commits. The instance URL and token frequently appeared together in commits, often within `.env` files or Claude Code permission files (e.g., `.claude/settings.json` or `.claude/settings.local.json`), which sometimes lack the same `.gitignore` safeguards applied to `.env` files. This co-location of hostnames and tokens eliminated the need for a separate infrastructure discovery step. A read-only validation request, passing the key via the `X-N8N-API-KEY` header to the `/api/v1/workflows` endpoint, confirmed token acceptance with a 200 HTTP response. Although n8n encrypts credentials at rest using `N8N_ENCRYPTION_KEY`, an attacker with sufficient API privileges could reference these stored credentials in new workflows, compelling the instance to use them on the attacker's behalf.
Impact
The exposure of n8n API tokens led to 321 live n8n instances being vulnerable to credential theft and unauthorized access. This represents approximately 36% of the 896 reachable instances tested and 26% of all 1,255 hostnames identified in the GitHub commits. An authenticated n8n token grants access according to the permissions of its creator, and many exposed tokens appeared to belong to instance owners or administrators. Depending on the account's role, the public REST API could expose sensitive information such as usernames, email addresses, account creation dates, and pending invitations via `GET /api/v1/users`. More critically, it could expose full workflow definitions via `GET /api/v1/workflows`. Given that n8n connects to databases, source code repositories, cloud environments, artificial intelligence services, and customer support platforms, a compromised token could expose workflow definitions and execution data, allow attackers to use stored credentials, and, in some configurations, enable the extraction of underlying credential values from these integrated systems.
Discovery & Response
The issue was discovered by GitGuardian researchers. Their GitGuardian Public Monitoring system scans public sources for exposed credentials. For this research, they specifically collected n8n API tokens identified in public GitHub commits since April 2025. A pipeline was used to extract n8n hostnames committed alongside each token, send read-only validation requests to associated instances, and record responses to confirm token acceptance.
How Fencio prevents this
Sensitive data and an outbound channel ended up in the same context. The agent did not need to be malicious. It only needed to be convinced that sending the data somewhere was part of the job.
Fencio tracks sensitive data as it moves through an agent session and checks every outbound path, from links and images to emails and API calls. When classified data is about to leave, or a series of answers adds up to something the requester is not entitled to see, the response is blocked or redacted.