n8n creators portal: templates still in review were readable without logging in
Severity: medium · Patch status: patched · Since 2026-10-16
On 16 October 2026 a creator reported that one of their unpublished n8n workflow templates had appeared on a third-party website. n8n found that parts of creators.n8n.io served templates still in review to anyone, without a login, and believes a third party used that to copy templates and list them elsewhere. n8n says the gap is closed and that it is reviewing the rest of the site for similar issues. Exposed for each template in review: its name and description, the submitter's creators.n8n.io username and the full workflow including node settings and any text the creator added; paid templates were exposed only as the settings-and-notes-stripped preview. n8n states that email addresses, passwords and account details were not exposed and that no one could edit or delete templates, and that exposed copies had already passed its automatic credential and personal-data removal, which it warns is imperfect. Creators are told to treat every template they submitted for review as public and that n8n does not retain original submissions, so a creator cannot check what was in the exposed copy. We are listing this as a supply-chain-adjacent exposure: a workflow template carries the embedded credentials, API keys and webhook URLs of whoever built it.
What to do
- Treat every template you submitted to creators.n8n.io for review as public: revoke or rotate any API key or credential that appears in a template you submitted, including ones removed by n8n's automatic scrub, since it is not guaranteed complete
- Replace webhook URLs that could trigger your workflows, and consider disabling or rotating credentials tied to triggers you do not recognise traffic from
- Ask third-party template aggregators to remove n8n templates copied from creators.n8n.io, and search for your workflow names outside n8n
- If a template carried another person's personal data, contact n8n (help@n8n.io) so they can help with next steps
- Audit n8n instance logs for executions triggered by unexpected webhooks or credentials that should no longer exist
- Anyone running n8n at work should check whether creators submitted templates on the company's behalf and rotate those credentials
Sources
All live incidents on Threat Watch
