CRITICAL n8n: n8n instance open — settings or owner-setup reachable without login
Why it matters
If your n8n setup page or settings endpoint answers without a login, a stranger can claim the instance as owner or read its configuration — and n8n holds your API keys and workflow credentials. Gate 0 testing showed bots hunting for credential files on exposed n8n within about an hour of the port going online.
Fix it — 3 steps
- Create the owner account immediately (visit /setup while logged in from a trusted network) so nobody else can; then confirm /rest/settings requires auth.
- Don't expose n8n on a public IP: bind it to 127.0.0.1 (N8N_LISTEN_ADDRESS=127.0.0.1) or your VPN interface, and reach it via VPN or an authenticating reverse proxy.
- Block the port at the firewall: `sudo ufw deny 5678`.
Verify it’s fixed
curl -m 5 http://YOUR_SERVER_IP:5678/rest/settings # should return 401/403 or time out, not a JSON settings blob
References
- https://docs.n8n.io/hosting/configuration/environment-variables/
- https://docs.n8n.io/hosting/securing/overview/
Not sure if your stack is exposed?
Run the free check — 30 seconds, safe read-only probes.
Scan your stack