Leaked tokens, a 9.9 Python flaw, and 321 live servers show why self-hosted n8n needs lockdown
On August 5, 2026, The Hacker News reported that leaked n8n API tokens exposed hundreds of live automation instances. Researchers found 321 publicly reachable servers still accepting credentials accidentally committed to GitHub. If you self-host n8n, this is not a niche warning. It shows the platform’s execution environment is a repeated target for remote code escape.
The most severe escape is a Python sandbox flaw tracked as CVE-2025-68668, scoring CVSS 9.9. It sits in n8n’s Python Code Node, which runs user scripts through Pyodide, a WebAssembly runtime meant to keep untrusted code isolated from the host system.
The isolation breaks because Pyodide includes a JavaScript interoperability bridge. Since n8n runs Pyodide inside the same process as the main application, an attacker can use Python to reach Node.js internals and invoke operating system commands with the same server privileges.
Version 2.0.0 patches the flaw by removing in-process Pyodide execution entirely. Anyone running an older self-hosted instance who cannot upgrade immediately can disable Python execution via the N8N_PYTHON_ENABLED=false flag to neutralize the threat.
Why exposure and tokens matter
The same August report finds that more than half of publicly visible n8n instances are running vulnerable versions. That means many operators are still exposed to known escape paths, even after fixes are available.
An earlier expression-injection flaw in the same severity range was added to the U.S. government’s catalog of actively exploited vulnerabilities in March 2026. That confirms attackers are already targeting n8n execution paths in the wild.
Leaked API tokens create a parallel risk. n8n API keys are signed JSON Web Tokens that often lack expiration dates. A credential exposed in a Git commit months ago can remain valid indefinitely unless you manually revoke it.
The report points to a broader problem. n8n is useful because it can run code and connect services, but those same features become dangerous when isolation fails.
A sandbox escape is not just a bug in one node. It can turn a workflow editor into a path to the host.
That is why the August findings matter together. A leaked token can provide entry, while a code-execution flaw can provide control. If an instance is public, unpatched, and still using old keys, the risk compounds quickly.
Close the gaps
Treat the fix as urgent if your instance is publicly reachable or runs Python workflows. Act today.
Self-hosted n8n users should treat code execution features as a privileged interface, not a convenience. Disabling Python nodes, rotating API keys with expiration dates, and keeping the instance updated are the minimum steps to prevent a workflow tool from becoming a server takeover vector.
Do you want to learn more about n8n and how to host it? CLICK HERE