321 n8n Instances Accept Leaked GitHub API Tokens
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- GitGuardian identified 4,576 unique n8n API credentials in public GitHub commits since April 2025; 321 of 896 reachable instances accepted at least one leaked token (36% of reachable, 26% of all 1,255 hostnames identified).
- CVE-2025-68613, a CVSS-9.9 expression injection flaw in n8n, was added to CISA's Known Exploited Vulnerabilities catalog on March 11, 2026, confirming active exploitation in the wild.
- Leaked n8n API tokens frequently have no expiration — the platform only introduced 30-day defaults in version 1.78.0 (February 2025), so tokens committed months earlier remain valid until manually revoked.
- The n8n audit endpoint returns SQL injection exposures, filesystem-access nodes, unprotected webhooks, and the running version — a ready-made attack map for any authenticated user.
- Claude Code permission files (.claude/settings.json) emerged as a newer leak vector, with users embedding n8n URLs and API keys inside approved curl commands that get committed without .gitignore safeguards.
- Of 372 n8n Model Context Protocol tokens found in the same commit set, 7 (roughly 2%) remained valid at testing — a smaller but newer exposure surface for AI-driven workflows.
Why it matters: The 321 accepting instances represent a credential-theft pipeline that bypasses patch management — organizations can't fix this by updating n8n; they must individually revoke old tokens, many of which carry no expiration. The Claude Code settings.json pattern extends the leak surface beyond traditional .env files into a category developers aren't yet trained to .gitignore.
