Workflow automation flaws: how a public form lets attackers steal stored credentials
ShiniFrontiers · Source: Pillar Security
What is it, and who gains?
Self-host n8n or a similar automation tool? One message through a public form can hand over every password it stores. Patch now — and check for a break-in first.
What it is: Research from Pillar Security showing that the automation tools many companies run to connect their apps — n8n is the main example, used by over 230,000 organisations — can be taken over from the internet through the formulas users are allowed to write.
Who it's for: Any company that self-hosts such a tool, or builds AI "agent" systems the same way.
The catch: The n8n holes are already patched, so an up-to-date copy is safe from these exact attacks; the researchers' wider claim — that this style of safety limit can never be fully secured — is a well-evidenced view, not a proof.
Your automation tool is a credential vault that runs strangers' code — for any company running its own workflow-automation platform
Problem: To do its job the tool stores the keys to every system it connects to, and it runs small code-like formulas, called expressions, that users supply. Both sit in the same place, guarded only by a sandbox. If a formula slips past it, it runs as a command on the server — a remote code execution flaw — and researchers broke n8n's sandbox three times in three months.
What it does: Once one formula escapes the sandbox, the attacker is already inside the vault: they read the single key that unlocks every stored credential and walk into the connected systems. One of the n8n holes needed no login — only a public web form. It is a bank whose night-deposit slot opens straight into the vault.
Note: Only self-hosted tools are exposed to the n8n holes; vendor-hosted services are patched by the vendor. The same weakness — and the same fix — applies to AI "agent" systems built the same way.
How an attack could unfold
| What the attacker does | What happens | What the attacker gains |
|---|---|---|
| 1. Get in: submits a booby-trapped message to the retailer's public "Contact Us" form | The tool treats a hidden formula in the message as a command and runs it, asking for no password | Control of the automation tool |
| 2. Take the master key: tells the tool to hand over the single key it uses to lock all its stored secrets | That one key unlocks every stored password, token and API key the tool holds | Keys to every connected system: payments, email, AI provider, database |
| 3. Redirect the AI calls: quietly changes the saved address the tool uses to reach its AI provider, pointing it at the attacker's own relay | Every future AI request, and the API key sent with it, now passes through the attacker first | A permanent, silent tap on the company's AI traffic and keys |
| 4. Stay hidden: leaves the tool running normally | The change is saved in the tool's database, so it survives restarts, and all security dashboards stay green | Lasting access the company's monitoring cannot see |
Illustrative attack on an invented online retailer; every step follows the researchers' demonstrated attack against n8n, entering through the unauthenticated public form (CVE-2026-27493). The source describes the technique, not a named victim.
- What a company gains
Treating the tool as a credential vault — isolating it, limiting who can reach it, keeping management off the internet, and rotating its secrets if it ran a vulnerable version — stops one break-in becoming total.
- What it would take
Staff time to find, update and lock down these tools; for the lasting fix, engineering work to separate where formulas run from where keys are stored.
- How ready
- In production use
The n8n holes are patched; the researchers proved the attacks themselves. The wider weakness in this kind of safety wrapper is unresolved across the category.
Join free to unlock: how it works, what to do now, what it could change for the business, and what is not yet proven.
Join free to read it all →