Leaked n8n API Tokens Exposed Live Instances to Credential Theft
What Happened — GitGuardian researchers discovered 321 n8n workflow‑automation instances whose API tokens had been inadvertently committed to public GitHub repositories. By scanning over 4 million commits they identified 4,576 unique tokens tied to 1,255 hostnames and demonstrated four attacker techniques that could harvest downstream credentials or retrieve sensitive data without exploiting any software flaw.
Why It Matters for Compliance & Audit Readiness
- Exposed API tokens are a classic credential‑compromise scenario that SOC 2 Access Control (CC6.1) and Security Awareness (CC6.2) requirements are designed to prevent and evidence.
- Continuous monitoring of secret leakage and documented secret‑rotation procedures provide the audit‑ready evidence needed to demonstrate “least‑privilege” and “secure‑configuration” controls.
Who Is Affected — SaaS/automation providers, DevOps teams, and any organization that integrates n8n workflows into production environments (primarily TECH_SAAS and API_PROVIDER segments).
Recommended Actions
- Immediately rotate all exposed n8n API tokens and enforce short‑lived secrets.
- Deploy automated secret‑scanning in CI/CD pipelines and Git repositories to catch future leaks.
- Map the incident to SOC 2 CC6.1 (Access Control) and CC6.2 (Security Awareness) controls, capture token‑rotation logs as audit evidence, and update your credential‑management policy.
Source: The Hacker News
Technical Notes
- Attack vector: Stolen credentials (publicly exposed API tokens).
- Data types at risk: Access to connected services, downstream API keys, and any data processed by n8n workflows.
- No CVE; the issue stems from insecure secret handling in source control.
Source: same as above