Full research report
Leaked n8n API Tokens Exposed Live Instances to Credential Theft
Executive assessment
GitGuardian's research reveals a systemic secrets-hygiene failure affecting workflow-automation infrastructure: 36% of reachable n8n instances accepted tokens leaked to public GitHub, granting authenticated access without any vulnerability exploitation. The risk is amplified by n8n's role as an integration hub — a single compromised token can expose credentials for dozens of connected services including databases, cloud environments and AI providers. CVE-2025-68613 independently provides an authenticated pathway to full remote code execution on unpatched instances; multiple public exploit scripts are verified, and an EPSS score in the 99.9th percentile reflects that exploitation is near-certain for exposed, unpatched deployments. Together, the credential-exposure and vulnerability surfaces make n8n a high-value pivot point for attackers with access to public repositories or internet-scanning capabilities, and the low disclosure-response rate observed during this research suggests the remediation gap remains wide.
What happened
GitGuardian researchers scanned public GitHub commits from April 2025 onwards and identified 4,576 unique n8n API tokens across 1,255 hostnames; of 896 reachable instances tested in August 2026, 321 (36%) accepted at least one leaked token, enabling authenticated access without any software vulnerability exploitation. Researchers demonstrated four practical attack techniques using only documented REST API calls, covering workflow exfiltration, stored-credential abuse and downstream service pivoting. This report follows the March 2026 addition of CVE-2025-68613 to the CISA Known Exploited Vulnerabilities catalogue, confirming that n8n simultaneously faces both a credential-exposure and a software-vulnerability attack surface. Only one of seven organisations notified during responsible disclosure revoked their credentials.
Affected scope
Any n8n instance — self-hosted or on n8n.cloud (approximately 30% of affected instances) — whose API token appears in public GitHub commits; over 100,000 instances are internet-visible via Shodan, with 58% of scanned instances as of March 2026 running a version affected by at least one known advisory; organisations using n8n to connect databases, cloud environments, AI services, source code repositories and customer support platforms face elevated downstream credential risk.
Technical assessment
n8n API tokens are signed JWTs; prior to version 1.78.0 (February 2025) no expiry was enforced by default, leaving tokens valid indefinitely until explicitly revoked from the database. A valid token provides REST API access to workflow definitions, execution histories, user account data and, in certain configurations, allows an attacker to redirect stored credentials to attacker-controlled endpoints. CVE-2025-68613 (CWE-913) independently compounds this risk: authenticated users crafting workflow expressions can escape the evaluation sandbox via constructor-chain access to the underlying Node.js runtime, achieving code execution with process-level privileges; multiple public exploit repositories confirm a low skill threshold for this pathway.
Recommended defensive actions
- Immediately audit all active n8n API tokens and revoke any lacking a valid expiry claim or not in current operational use
- Patch CVE-2025-68613 by upgrading n8n to version 1.120.4, 1.121.1 or 1.122.0 at minimum; also address CVE-2026-25049 by upgrading to 1.123.17 or 2.5.2
- Scan public GitHub repositories and commit history for exposed n8n API tokens using GitGuardian, GitHub secret scanning or equivalent tooling
- Enforce token expiry by ensuring all instances run n8n 1.78.0 or later and audit existing tokens for absent exp claims
- Monitor n8n API logs for requests from unexpected source IP addresses or anomalous query patterns that may indicate token abuse
Uncertainties and evidence gaps
- No specific threat actor has been publicly attributed to exploitation of CVE-2025-68613 or to abuse of leaked API tokens in production environments
- The number of organisations actively compromised via leaked tokens is unknown; responsible disclosure to seven affected parties yielded only one revocation response
- Whether any of the seven still-valid MCP tokens found during research have been weaponised in attacks is unconfirmed
- The NIST CVSS score of 8.8 differs materially from the GitHub CNA score of 9.9, reflecting a scope disagreement on whether exploitation can impact systems beyond the n8n process boundary
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
CVE-2025-68613 confirmed actively exploited and added to CISA KEV on 11 March 2026; the credential-theft attack chain described in this research requires no CVE exploitation — a leaked API token alone provides authenticated access to 36% of tested reachable instances.
Investigation separated two co-existing attack surfaces: a credential-exposure campaign documented by GitGuardian (August 2026) and an actively exploited expression injection vulnerability (CVE-2025-68613, CISA KEV March 2026). Primary sources at NVD, GitHub and GitGuardian were verified to confirm token exposure statistics, CVE severity, patch versions and exploit availability. Independent corroboration came from a Canadian government advisory confirming both active threat status and public PoC availability. The evidence supports a high-confidence assessment: credential theft via leaked tokens and CVE exploitation are both practical, active risks for any internet-accessible n8n deployment.
- What are the confirmed details of CVE-2025-68613 and is it genuinely in CISA KEV?Fetched NVD vulnerability record for CVE-2025-68613nvd.nist.gov ↗
Confirmed CVSS 8.8 (NIST) / 9.9 (GitHub CNA), CWE-913, affects n8n 0.211.0 through 1.121.0, CISA KEV added 11 March 2026 with remediation deadline 25 March 2026, patched in 1.120.4, 1.121.1 and 1.122.0
why Established the vulnerability as authoritatively confirmed-exploited and set the severity and version scope baseline for the rest of the assessment
- What did GitGuardian actually find and publish about leaked n8n tokens?Fetched GitGuardian primary research blog post on n8n credential and encryption key exposureblog.gitguardian.com ↗
4,576 unique API tokens found in public GitHub commits across 1,255 hostnames; 321 of 896 reachable instances (36%) accepted leaked tokens; four attack techniques demonstrated using only documented REST API calls; 129 instances used known-weak N8N_ENCRYPTION_KEY values; CVE-2026-25053 also covered
why Provided the primary technical evidence for the credential-theft attack surface and confirmed the research was not dependent on CVE exploitation
- Is public exploit code available for CVE-2025-68613, and at what skill level?Searched for and fetched a CVE-2025-68613 PoC repository on GitHubgithub.com ↗
Verified repository contains a full exploit script, a passive scanner and a Nuclei template; sandbox escape uses this.constructor.constructor() to access Node.js runtime and execute system commands
why Confirmed a low skill-barrier for exploitation, warranting explicit inclusion in defensive actions and elevating the overall risk assessment
- Is there independent government-level corroboration of active exploitation status?Fetched Canadian Centre for Cyber Security advisory AL26-001cyber.gc.ca ↗
CCCS confirmed active threat and public PoC availability as of 7 January 2026 for CVE-2025-68613 and two related n8n CVEs; recommended immediate patching and endpoint restriction
why Provided independent non-US government corroboration satisfying the two-source independence requirement and confirming PoC availability prior to this story
- What is the scale of internet-facing unpatched n8n exposure and what is the KEV enforcement context?Fetched The Hacker News March 2026 article on CISA flagging n8n RCEthehackernews.com ↗
Over 24,700 unpatched instances remained online as of early February 2026; 58% of scanned instances running a vulnerable version; CVE-2025-68613 was the first n8n entry in CISA KEV; US federal agencies mandated to patch by 25 March 2026
why Contextualised the persistent scale of unpatched exposure and confirmed that this story sits within a sustained, escalating security problem for the n8n ecosystem
- Did the THN article accurately reflect the GitGuardian research, and were any additional facts present?Fetched The Hacker News August 2026 article on leaked n8n API tokensthehackernews.com ↗
Article accurately summarises GitGuardian research; adds that only one of seven notified organisations revoked credentials and that approximately 30% of affected instances were on n8n.cloud managed infrastructure
why Confirmed article integrity and added disclosure-response detail that underscores the ongoing remediation gap at the organisational level
Research coverage
All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1661 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7492 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok672 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1007 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Vulnerability & exploitation2
Reporting-linked PoC claims1
Linked by reporting but not validated as PoC by the configured exploit indexes.
Technical references1
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code1
Verified repository with full exploit, passive scanner and Nuclei template; sandbox escape uses this.constructor.constructor() to access Node.js runtime
Vendor & gov advisories3
Official record; CVSS 8.8 (NIST) / 9.9 (GitHub CNA), CWE-913, CISA KEV added 11 March 2026, patched in n8n 1.120.4, 1.121.1, 1.122.0
Vendor advisory confirming CVE-2025-68613 scope, affected versions and recommended patch
Government corroboration of active threat and public PoC availability as of 7 January 2026
Analysis & research2
Primary research source: 4,576 leaked tokens identified, 321 instances accepting them, four attack techniques demonstrated using only documented REST API calls
Reports scale of unpatched internet-facing exposure and CISA KEV addition context