[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpwmXMkA8VO3iUrWavS-wmyF-RzDAZqdLVoyzBlk84CQ":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"829b1e4a-56c6-4c10-8eb1-04ab2a537867","Leaked n8n API Tokens Exposed Live Instances to Credential Theft","leaked-n8n-api-tokens-exposed-live-instances-to-credential-theft-b4f3d4","GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to access sensitive data and downstream credentials without exploiting a software vulnerability. We scanned public GitHub commits for exposed n8n API tokens and identified 4,576 unique credentials associated with 1,255 hostnames. Of the 896","Researchers discovered that hundreds of n8n automation platform instances were exposed to credential theft due to API tokens being leaked in public GitHub commits. Attackers could leverage these tokens to access sensitive data and downstream credentials without exploiting software vulnerabilities, impacting workflows connected to databases, cloud environments, and AI services.","Leaked n8n API tokens in GitHub commits exposed hundreds of live instances to credential theft.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fleaked-n8n-api-tokens-exposed-live.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhx1pOdsqya8FoeUfRoysn2429wQSGELUYOuuaDRT5-pJMERQc7DY042ndusTV0UriGHrR98oyPe_HnR845R1hxSxKBTvYGTilYobQhIIXOCEc08FiKbhDluP0UoR6g3sw8QK-X1aPEJDKe-EZbDNOtlXR6ltGBvxsqfB_bo-jO4t63OvT7_C1mD7Bf4rM\u002Fs1600\u002Fn8n-git.gif","2026-08-05T10:35:29+00:00","2026-08-05T12:00:15.941277+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"n8n","product",{"name":21,"type":22},"GitGuardian","vendor",{"name":24,"type":25},"API tokens","technology",{"name":27,"type":25},"workflow automation",{"name":29,"type":25},"AI","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54],{"type":55,"value":56,"context":57},"cve","CVE-2025-68613","Expression injection vulnerability in n8n with a CVSS score of 9.9, confirmed to be exploited in the wild.",[21,18],{"controls":60,"vendors":140},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":34,"name":91,"problem":92,"products":93},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":119,"name":120,"problem":121,"products":122},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[123,124,132],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[141],{"slug":142,"name":21,"logo_path":143,"roles":144},"gitguardian","\u002Fvendor-logos\u002Fgitguardian.png",[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":162},"leaked-n8n-api-tokens-enable-credential-theft-via-public-github-commits","Leaked n8n API Tokens Enable Credential Theft via Public GitHub Commits","Hundreds of n8n automation platform instances were compromised because developers inadvertently committed API tokens to public GitHub repositories, exposing live credentials to anyone who found them. This attack required no software vulnerability — valid tokens alone granted attackers full access to sensitive workflows, databases, cloud services, and AI integrations. The incident highlights a persistent human error pattern where secrets management is treated as an afterthought during development. When automation platforms are involved, a single leaked token can cascade into a broad breach across every connected downstream system, dramatically amplifying the blast radius.",[151,152,153,154,155,156,157,158,159,160,161],"CIS Control 3.11 – Encrypt Sensitive Data at Rest","CIS Control 4.7 – Manage Default Accounts on Enterprise Assets","CIS Control 14.9 – Enforce Detail Logging for Sensitive Data Access","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 SI-12 – Information Management and Retention","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST CSF PR.AC-1 – Identities and credentials are issued, managed, verified, revoked","GDPR Article 32 – Security of Processing (appropriate technical measures)","OWASP Top 10 A02:2021 – Cryptographic Failures (secrets exposure)","ITIL – Service Configuration Management (managing credentials as configuration items)",{}]