Workflow automation flaws: how a public form lets attackers steal stored credentials
Self-host n8n or a similar automation tool? One message through a public form can hand over every password it stores. Patch now — and check for a break-in first.
What it is: Research from Pillar Security showing that the automation tools many companies run to connect their apps — n8n is the main example, used by over 230,000 organisations — can be taken over from the internet through the formulas users are allowed to write.
Who it's for: Any company that self-hosts such a tool, or builds AI "agent" systems the same way.
The catch: The n8n holes are already patched, so an up-to-date copy is safe from these exact attacks; the researchers' wider claim — that this style of safety limit can never be fully secured — is a well-evidenced view, not a proof.