Leaked n8n API Tokens Exposed Live Instances to Credential Theft
Leaked n8n API tokens in GitHub commits exposed hundreds of live instances to credential theft.
Researchers discovered that hundreds of n8n automation platform instances were exposed to credential theft due to API tokens being leaked in public GitHub commits. Attackers could leverage these tokens to access sensitive data and downstream credentials without exploiting software vulnerabilities, impacting workflows connected to databases, cloud environments, and AI services.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitGuardian?
Get an email when a new story names GitGuardian, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHundreds of n8n automation platform instances were compromised because developers inadvertently committed API tokens to public GitHub repositories, exposing live credentials to anyone who found them. This attack required no software vulnerability — valid tokens alone granted attackers full access to sensitive workflows, databases, cloud services, and AI integrations. The incident highlights a persistent human error pattern where secrets management is treated as an afterthought during development. When automation platforms are involved, a single leaked token can cascade into a broad breach across every connected downstream system, dramatically amplifying the blast radius.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2025-68613