n8n Security: How Leaked API Keys Expose Your Encryption Key
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
GitGuardian researchers traced a full attack chain against self-hosted n8n instances, starting from leaked API keys and ending at the N8N_ENCRYPTION_KEY that protects every stored credential. Three cryptographic weaknesses were identified: JWT secret derivation that discards half the key's entropy, session forgery for OIDC-provisioned users, and session forgery for pending users. A scan of 31,793 internet-exposed n8n instances found 129 using known weak encryption keys recoverable from public artifacts. A separate GitHub scan found 4,576 unique n8n API tokens, with 321 still valid against reachable instances. CVE-2026-25053, a critical arbitrary file-read vulnerability in n8n's Git node (fixed in v1.123.10 and v2.5.0), was demonstrated as an escalation path from API access to encryption key and credential database compromise. The post concludes with a hardened configuration baseline covering secret generation, API surface reduction, node exclusion, task runner isolation, and continuous auditing.
