CuraSec

tag: Secrets-Exposure · 2 items

Act 321 Live n8n Instances Exposed via API Tokens in Public GitHub Repos
2026-08-05 · The Hacker News · source ↗ #secrets-exposure#n8n#credential-theft
  • Engineer — Act: If your org runs n8n, scan your GitHub repos immediately for exposed API tokens using GitGuardian or truffleHog, then rotate any identified credentials and review what downstream integrations those tokens had access to.
  • SOC/IR — Plan: The four documented abuse paths (credential pivoting via workflow API) are worth translating into detection queries for anomalous n8n API calls; build coverage for unexpected data exfiltration from workflow automation platforms this quarter.
  • Leader — Learn: This research illustrates how workflow-automation tools become credential aggregators — a useful data point for a secrets-management policy review, but no same-week leadership action is indicated unless n8n is confirmed in use with public-facing repos.
Act archived Spring Boot /actuator/heapdump endpoint exposes secrets in memory
2026-07-27 · SANS ISC · source ↗ #spring-boot#secrets-exposure#misconfiguration
  • Engineer — Act: Audit all Spring Boot deployments for exposed /actuator/heapdump endpoints — this endpoint leaks in-memory secrets including API keys and DB credentials. Disable or restrict actuator endpoints via Spring Security configuration if not required.
  • SOC/IR — Plan: Build a detection for inbound GET requests to /actuator/heapdump in web/proxy logs; active scanning activity means attackers are already probing for this endpoint in your estate.
  • Leader — Skip