0x324 - Teknik - N8ive by design - one leaked key, three attack chains (leHACK)

Value of the Information & Strength of the Argument

The value of the information is high, as it provides concrete insights into the security of a widely used automation platform. The argumentation is solid, based on hands-on research and real-world examples. Guillaume clearly explains the methodology and findings, and the discussion is well-structured. The use of LLMs in vulnerability research is a novel and interesting angle, adding practical value for security researchers.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is good, with references to CVE databases, KEV catalog, and responsible disclosure practices. However, the discussion lacks formal citations or links to specific sources. The title accurately reflects the content, focusing on a leaked key and attack chains. The content is based on expert opinion and original research, but not peer-reviewed. The public comments are not provided, so no analysis of public reception is possible.

The title accurately reflects the content: a technical discussion about n8n security, focusing on a leaked key and multiple attack chains, presented at leHACK.

8/10

The content is an expert interview with a security researcher from GitGuardian, discussing a real-world security analysis of n8n. The claims are based on hands-on research, with references to CVE databases and responsible disclosure practices. The discussion is technical and grounded, though it lacks formal citations or peer-reviewed sources.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 00:00Introduction and context of the research
• 02:00Genesis of the research: internal adoption, CVE explosion, and KEV catalog
• 05:00Phase 1: Detection and validation of n8n JWT tokens
• 08:00Phase 2: Attack paths on up-to-date instances
• 10:00Phase 3: Exploiting outdated instances to dump secrets
• 12:00Discussion on n8n security weaknesses and recommendations
• 15:00Use of LLMs in vulnerability research
• 18:00Conclusion and advice for researchers

• CISA KEV Catalog — Mentioned as evidence of active exploitation of n8n vulnerabilities.
• n8n CVE database — Referenced as the source of CVE information for n8n.
• GitGuardian — The company where the researcher works, and the source of the research.

• CISA KEV Catalog — Confirms active exploitation of n8n vulnerabilities.
• n8n security advisories — Official security advisories for n8n.

• n8n's response to disclosures — The researcher mentioned that n8n did not always respond to vulnerability reports, indicating a potential lack of concern.