Is n8n safe to self-host?
Yes, if you harden it. In 2026 researchers disclosed two maximum-severity flaws in n8n, and GitGuardian found 321 n8n instances accepting leaked GitHub tokens. The software is fine; exposed, unpatched instances are not.
What went wrong in those incidents?
Leaked API tokens plus internet-facing instances. A single valid token could read workflows, data and downstream credentials. The fix is boring and effective: rotate keys, restrict who can reach the instance, and patch quickly.
What is the hardening checklist?
Pin versions and patch on a schedule. Put n8n behind authentication or a private network, never the open internet by default. Rotate API keys and scope them minimally. Encrypt stored credentials. Turn on audit logging, back up workflows, and alert on unusual executions.
How does this affect resellers?
It is your liability and your reputation. If you install n8n for a client and it leaks, the client remembers who installed it. Treat hardening as part of the install and a selling point, not an optional extra.
What should buyers ask before an install?
Ask where it will run, who can reach it, how keys are stored, how patching works and where backups live. A serious installer has specific answers. 'It just works' is not one of them.
Frequently asked questions
Is n8n secure?
n8n is safe when self-hosted with authentication, network restrictions, scoped and rotated keys, encrypted credentials and prompt patching. Exposed, unpatched instances are the risk.
What were the 2026 n8n vulnerabilities?
Researchers reported two maximum-severity flaws, and GitGuardian found 321 instances accepting leaked GitHub tokens that could expose workflows and credentials.
How do I protect a self-hosted n8n?
Put it behind auth or a VPN, rotate and scope API keys, encrypt credentials, enable audit logs, back up workflows and patch versions promptly.
Want the full playbook?
The free 2026 AI Revenue Playbook turns these shifts into a plan with costs, scripts and pricing templates.