Security researchers discovered that leaked credentials published on GitHub provided authenticated access to 321 n8n workflow automation instances, representing 36% of all reachable systems they tested. GitGuardian, which published the findings, scanned public GitHub commits for exposed n8n API tokens and then demonstrated four ways attackers could leverage those credentials to reach sensitive information and downstream access keys without exploiting any software flaw. The research reveals how a single leaked token can create a path toward source code repositories, databases, cloud infrastructure, artificial intelligence services, and customer support systems.
The scan identified 4,576 unique API tokens spread across 5,469 GitHub commits, associated with 1,255 distinct hostnames. Of the 896 instances that were publicly reachable when researchers conducted their tests, 321 accepted at least one leaked token—roughly 26% of all hostnames found in the commits. Researchers also examined a newer credential type called MCP tokens, which allow AI assistants to trigger n8n workflows through the Model Context Protocol. Out of 372 MCP tokens identified, seven remained valid at the time of testing, or approximately 2%. The research found that 58% of scanned instances were running a version affected by at least one known security advisory as of March 31, 2026. About 30% of the 321 affected instances were hosted on n8n.cloud or comparable managed services.
According to the report, many older n8n API keys were generated without expiration dates, meaning "a key committed to GitHub months earlier could therefore remain usable until someone explicitly deleted or revoked it." The researchers found that instance URLs and tokens frequently appeared together in the same commit, particularly in .env files and Claude Code permission files. The report explains that an n8n token provides access according to the permissions of the user who created it, and many exposed tokens appeared to belong to instance owners or administrators—likely because those users were configuring integrations and committing the keys. In controlled tests, researchers successfully enumerated users and complete workflow definitions, ran arbitrary OpenAI prompts using a stored credential without seeing its value, exfiltrated data table contents, and extracted the raw underlying credential by pointing an HTTP request node at an attacker-controlled listener.
The report emphasizes that automation platforms create an unusually large blast radius because they connect multiple systems, process sensitive information, and routinely authenticate to external services. A sufficiently privileged n8n token can expose workflow definitions and execution data, allow attackers to use stored credentials, and in some configurations enable them to extract the underlying credential values. The research demonstrated that attackers could delete malicious workflows after execution, potentially removing associated execution records from the interface and leaving defenders with limited evidence to investigate. One real-world workflow researchers encountered automatically backed up its own definitions to a public GitHub repository with an SSH deployment key hard-coded directly into a node—effectively publishing its own sensitive configuration and credentials each time it ran.
GitGuardian attempted responsible disclosure with seven organizations, but only one—which operated a bug bounty program—acknowledged the report, paid a $1,200 bounty, and revoked the credential immediately. The other six either did not respond or provided limited engagement. The report concludes that revoking the exposed n8n token is only the first step: organizations should determine which workflows, data, and downstream credentials the account could access, review the instance for unauthorized changes, and rotate connected credentials where exposure can't be ruled out. The authors emphasize that the risk extends beyond the automation platform itself to every system connected to it. Workflow automation sits at the center of enterprise integrations, making credential hygiene failures particularly consequential—and token exposure particularly difficult to contain once an attacker establishes initial access. The episode illustrates a broader tension between developer velocity and secrets management: platforms designed to accelerate integration work can just as easily accelerate the propagation of compromise when credentials leak into version control.