Leaked n8n API tokens in public code exposed live automation instances

GitGuardian found 321 live n8n automation instances reachable using API tokens that developers had accidentally committed to public GitHub repositories, and showed four ways an attacker could abuse them. n8n workflows often hold credentials for the services they connect, so a valid API token can expose not just the automation platform but the downstream accounts it touches, from cloud services to messaging and databases. Because n8n is widely self-hosted and frequently wired into sensitive systems, an exposed token can become a path to broader compromise. The finding is a reminder that secrets committed to source control remain one of the most reliable ways in.

Check

Scan your repositories and history for committed n8n API tokens and other secrets, rotate anything exposed, and confirm n8n instances are not reachable from the internet without protection.

Affected

Teams self-hosting n8n whose API tokens reached public code; an attacker can drive the automation platform and reach the downstream credentials stored in its workflows, from cloud services to databases.

Fix

Rotate exposed tokens, add automated secret scanning to block commits, scope n8n credentials tightly, keep instances behind authentication and off the public internet, and audit workflows for stored downstream credentials.