Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations utilizing n8n automation instances
Incident: Exposure of n8n API tokens via public GitHub commits.
Impact: Unauthorized access to automation workflows and potential theft of downstream third-party credentials.
Attacker: Unidentified threat actors
Analysis: GitGuardian identified thousands of leaked n8n API tokens in public GitHub commits, with over 300 live instances currently vulnerable. Since n8n orchestrates critical business logic and connects to various cloud services, these tokens provide a direct path to downstream credential theft. The risk is magnified by the platform’s ability to store and use highly privileged keys for external databases and APIs.
Recommendations: Audit public GitHub repositories for leaked n8n API tokens and revoke them immediately.; Implement a secrets management tool to prevent hardcoding API keys in version control.; Enforce strict API permissioning and regularly rotate the N8N_ENCRYPTION_KEY.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source