Recent research by GitGuardian has uncovered a significant security risk involving n8n, an open-source workflow automation tool, where 321 live instances were found to be accepting exposed API tokens from public GitHub commits. The study identified a total of 4,576 unique credentials linked to 1,255 hostnames, showcasing the potential for attackers to exploit these tokens without the need for traditional software vulnerabilities. The researchers demonstrated four distinct methods by which malicious actors could access sensitive data and downstream credentials, emphasizing the ease with which these credentials can be misused once exposed.
For businesses utilizing n8n or similar tools, these findings underscore the urgent need for robust credential management practices. Companies must implement stringent monitoring and scanning protocols to detect and remediate exposed API tokens promptly. This incident highlights broader implications for cybersecurity and AI, as the increasing reliance on automation and integration tools raises the stakes for credential security. Organizations should prioritize education and training for their development teams about secure coding practices to mitigate the risk of credential leakage and enhance their overall cybersecurity posture.
---
*Originally reported by [The Hacker News](https://thehackernews.com/2026/08/leaked-n8n-api-tokens-exposed-live.html)*