n8n Reports Security Incident Involving Internal Metabase Analytics Environment

n8n Reports Security Incident Involving Internal Metabase Analytics Environment n8n disclosed an unauthorized access incident stemming from a vulnerability in its internal Metabase analytics tool, affecting 136 user records and triggering credential rotations and regulatory notifications. An unauthorized third party queried data in n8n's Metabase environment on 3 August 2026 before the vulnerability was patched. Forensic review confirmed 136 records with names and emails were accessed, including five n8n Cloud bcrypt-hashed passwords. As a precaution, n8n also contacted 25 users tied to a previously resolved plain-text password bug and alerted Berlin data protection authorities. Incident Details and Data Impact On 6 August 2026, n8n was alerted to unauthorized activity that took place on 3 August 2026 via Metabase, an internal third-party analytics tool. An investigation confirmed that an attacker queried n8n data, accessing 136 records containing names and email addresses of both self-hosted and n8n Cloud users. Five of those records contained bcrypt-hashed passwords for n8n Cloud accounts, whereas self-hosted passwords are not shared with n8n. The investigation also identified 25 n8n Cloud accounts affected by a previously fixed bug that stored passwords in plain text; although access to these was deemed unlikely, all 25 holders were notified directly. Remediation and User Guidance Metabase patched the flaw, terminated active sessions, and revoked compromised credentials. n8n reviewed audit logs, rotated potentially affected credentials, addressed users affected by the historical bug, and notified its Data Protection Officer as well as the Berlin Commissioner for Data Protection and Freedom of Information. n8n advised users who received direct emails to reset their passwords immediately, while noting that other users whose personal data was not involved may still reset n8n Cloud passwords as a precautionary measure.

n8n通报内部Metabase安全事件调查进展及受影响情况 n8n发布针对其内部使用的第三方分析工具Metabase安全事件的更新通报，披露攻击者访问了涉及部分用户的136条记录，并说明了已采取的补救和监管通知措施。 未经授权的第三方于2026年8月3日利用Metabase漏洞访问并查询了n8n环境中的数据，相关漏洞已被修补。 共有136条包含姓名和邮箱的记录被访问，其中5条包含n8n Cloud账户的bcrypt哈希密码，自托管密码未受影响。 调查还发现一个此前已修复的历史漏洞曾导致少数密码明文存储，官方已预防性通知相关的25名账户所有者。 官方已轮换潜在受影响凭证并向柏林数据保护与信息自由专员报备，呼吁收到邮件通知的用户尽快重置密码。 事件起因与影响范围 n8n于2026年8月6日获悉其内部使用的Metabase分析工具发生安全事件，未经授权的活动发生于8月3日。经调查，攻击者访问并查询了部分数据，确认共有136条包含姓名和电子邮箱的自托管与n8n Cloud用户记录被访问。其中，5条记录包含n8n Cloud账户的bcrypt哈希密码，而自托管密码从未与n8n共享。 历史缺陷与应对举措 调查过程中还发现了一项此前已修复的历史漏洞，该缺陷曾导致少数n8n Cloud密码以明文形式存储；尽管认为这些记录在此次事件中被访问的可能性不大，官方仍向全部25名相关账户持有人发送了通知。Metabase方面已修复漏洞、终止相关会话并吊销涉事凭据。n8n已审查审计日志、轮换潜在受影响的凭据，并向数据保护官以及柏林数据保护与信息自由专员进行了通报。收到官方直发邮件的用户被要求尽快重置密码。

**Update — 11 August 2026, 18:00 CEST**: Further forensic analysis has allowed us to identify the specific records the attacker accessed in most of the affected data tables. To give a more precise breakdown of the reported 136 records: We have contacted everyone in these first three groups directly by email. If we have not contacted you directly, your personal data was not involved in this incident. We were made aware on 6 August 2026 of a security incident affecting Metabase, a third-party analytics tool used internally by n8n. The unauthorised activity took place on 3 August 2026 - Metabase has since patched the vulnerability that allowed it. We immediately began an investigation with Metabase and our security, legal, and data teams. Our investigation confirmed that an unauthorized third party accessed and queried certain data available through n8n’s Metabase environment. We're publishing this update to explain what we found and the action we're recommending for a small number of affected accounts. **What information was involved** We have confirmed that 136 records containing names and email addresses were accessed across all of our users, both self-hosted and n8n Cloud. Five of these records contained bcrypt-hashed passwords of n8n Cloud accounts, self-hosted passwords are never shared with n8n. Because the queries used returned a variable, non-deterministic set of rows each time they are run, we cannot determine which specific records were accessed. Our investigation also identified a historical bug, which was previously [fixed](https://github.com/n8n-io/n8n/pull/5842), that caused a small number of n8n Cloud account passwords to be stored in plain text. Whilst we consider it unlikely that these records were accessed during this incident, we have contacted all 25 account holders directly as a precaution. **What we have done** Metabase has patched the vulnerability, terminated the relevant sessions, and revoked the credentials used in the incident. Since being notified, we have been reviewing our own audit logs; rotated potentially affected credentials; rectified any users affected by the historical bug; and notified our Data Protection Officer as well as the Berlin Commissioner for Data Protection and Freedom of Information. **What you should do** If you received a direct email from us about this incident, please follow the instructions in that email and reset your password as soon as possible. If we have not directly contacted you about this, you may still choose to reset your n8n Cloud password as an additional precaution. You can reset your password at any time on the page described in [this helpdesk article](https://support.n8n.io/article/how-do-i-change-my-email). **Questions** If you have questions about this notice or your account, please contact [help@n8n.io](mailto:help@n8n.io). We take the security of your account seriously and are sorry for the concern this may cause. The n8n team