n8n Workflow Automation API Enumeration for 2026-10-23

Oct 23, 2026 Exploitation

Last Updated: 00:00 UTC

Enumeration of the n8n REST API (/rest/workflows, /rest/executions, /rest/credentials-for-node, /rest/oauth2-credential). n8n stores OAuth tokens and API keys for every service its workflows touch, and a workflow can run shell commands, so an exposed instance yields both credentials and code execution.

MITRE ATT&CK

Tactic: Discovery (TA0007)
Technique: T1046 — Network Service Scanning

Observed URIs

Attackers by Country

France: 5The Netherlands: 2
France571.4%
The Netherlands228.6%

IP Address : ASN : City/Provider

  • 185.177.72.13 : AS211590 Bucklog SARL : France

  • 185.177.72.22 : AS211590 Bucklog SARL : France

  • 185.177.72.23 : AS211590 Bucklog SARL : France

  • 185.177.72.51 : AS211590 Bucklog SARL : France

  • 185.177.72.52 : AS211590 Bucklog SARL : France

  • 45.148.10.119 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.21 : AS48090 Techoff Srv Limited : Amsterdam

Share on: