GitGuardian researchers discovered 321 active n8n workflow automation instances accepting exposed API tokens left in public GitHub commits. The research identified 4,576 unique credentials tied to 1,255 hostnames, revealing a widespread credential exposure problem among organizations using n8n.

The researchers demonstrated four attack methods requiring no software vulnerability exploitation. Attackers with stolen API tokens can enumerate workflows, extract credentials stored within n8n instances, access connected systems through credential objects, and export sensitive data without triggering alerts. The exposure affects organizations across industries that rely on n8n for integrating APIs and automating business processes.

N8n stores credentials for hundreds of third-party services including cloud platforms, databases, payment processors, and communication tools. An attacker with API access gains the ability to retrieve plaintext or weakly encrypted credentials, then pivot into downstream systems. This creates a compounding risk where a single GitHub commit containing an n8n API token becomes an entry point to multiple connected infrastructure components.

The attack doesn't require identifying patched vulnerabilities or waiting for updates. Developers routinely commit API tokens by mistake during rapid development cycles. GitHub's public repositories remain permanently indexed and searchable by security researchers and threat actors alike. Organizations often lack visibility into which credentials they've committed historically.

GitGuardian's scanning methodology checked commits dating back several years, but the research didn't specify how many of the 321 instances remained actively vulnerable at the time of discovery. The timeframe between token exposure, researcher notification, and remediation varies significantly across organizations.

Organizations using n8n should rotate all API tokens immediately, implement secret scanning in CI/CD pipelines, and restrict n8n instance access to authorized networks only. Developers need training on credential management. N8n administrators should audit credential objects for unnecessary permissions and enforce IP whitelisting on API endpoints. Regularly scanning historical commit logs for exposed credentials remains essential