n8n Workflow Automation API Enumeration for 2026-10-21

Oct 21, 2026 Exploitation

Last Updated: 00:00 UTC

Enumeration of the n8n REST API (/rest/workflows, /rest/executions, /rest/credentials-for-node, /rest/oauth2-credential). n8n stores OAuth tokens and API keys for every service its workflows touch, and a workflow can run shell commands, so an exposed instance yields both credentials and code execution.

MITRE ATT&CK

Tactic: Discovery (TA0007)
Technique: T1046 — Network Service Scanning

Observed URIs

Attackers by Country

France: 3Bulgaria: 1
France375.0%
Bulgaria125.0%

IP Address : ASN : City/Provider

Share on: