Leaked n8n API Tokens Enable Credential Theft via Public GitHub Commits
Written by AI from the linked story. Not reviewed by an editor. How this works
Hundreds of n8n automation platform instances were compromised because developers inadvertently committed API tokens to public GitHub repositories, exposing live credentials to anyone who found them. This attack required no software vulnerability — valid tokens alone granted attackers full access to sensitive workflows, databases, cloud services, and AI integrations. The incident highlights a persistent human error pattern where secrets management is treated as an afterthought during development. When automation platforms are involved, a single leaked token can cascade into a broad breach across every connected downstream system, dramatically amplifying the blast radius.
Tactical Insight
Immediate actions
- Rotate and revoke all n8n API tokens immediately if any have been committed to public or private repositories.
- Scan all public and private GitHub repositories for exposed secrets using tools such as GitHub Secret Scanning, TruffleHog, or Gitleaks.
- Audit active n8n workflow connections to identify any unauthorized access or data exfiltration in connected services.
Long-term improvements
- Enforce pre-commit hooks (e.g., git-secrets, detect-secrets) across all developer workstations to block secrets from entering version control.
- Store all API tokens and credentials in a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) and inject them at runtime rather than hardcoding them.
- Implement least-privilege scoping for all API tokens so each token grants only the minimum permissions required for its specific workflow.
Detection measures
- Enable continuous repository monitoring and alerting for newly committed secrets using automated scanning integrated into CI/CD pipelines.
- Set up logging and anomaly detection on n8n API usage to flag unusual access patterns, off-hours activity, or unexpected geographic origins.
- Establish a token lifecycle policy with automatic expiration and periodic rotation schedules enforced by tooling.