Censys report finds 114,000 exposed n8n instances with critical vulnerabilities

Censys released its fifth annual State of the Internet Report on October 14, 2026, highlighting a significant security gap in self-hosted automation tools. The analysis identified approximately 113,926 publicly exposed n8n instances, making it the most widely exposed AI-related product on the internet. More concerning is the patch status: among those with detectable version numbers, 76% were running software vulnerable to at least one recent critical flaw.

What happened

The Censys Advanced Research Collective analyzed the Censys Internet Map to track the growth of exposed AI infrastructure. Between October 2025 and July 2026, this category grew by 63%, reaching nearly 268,000 systems. These are not merely public chatbots but backend tools that connect artificial intelligence models to private data, applications, and user accounts. n8n topped the list with roughly 114,000 exposed hosts, followed by OpenClaw, a personal AI agent assistant, with about 54,000 hosts.

Geographically, the United States, China, and Germany host the majority of these exposed systems, accounting for just over half of the total. The report emphasizes that exposure alone is risky, but the combination of public accessibility and unpatched software creates immediate danger. Automated scanners do not need human intervention to find these instances; they continuously probe the entire internet, cataloging any service that responds on a public IP address.

A secondary finding challenges a common misconception about network security. The report noted that 68% of exposed HTTP services and 34% of SSH services operated on non-standard ports. This indicates that changing default port numbers provides no meaningful protection against wide-scale scanning. Attackers and researchers alike enumerate all 65,535 ports, meaning obscurity is not a viable defense strategy.

Key details

• Scale of exposure: n8n is the most exposed AI product with ~114,000 public hosts, significantly ahead of the second-place tool.
• Vulnerability rate: 76% of n8n instances with parseable versions were running software affected by at least one recent critical vulnerability.
• Geographic distribution: The US (62,687), China (42,511), and Germany (31,222) hold the largest shares of exposed AI infrastructure.
• Port myth debunked: Most exposed services use non-standard ports, proving that port shifting does not hide services from internet-wide scanners.
• Broader context: The report also found 134,000 exposed industrial control systems, with 70% located on consumer or mobile networks.
• Growth trend: Exposed AI infrastructure increased by 63% in just nine months, signaling a rapid expansion of attack surface.

Background

n8n is a popular workflow automation tool that allows users to connect various apps and services without writing extensive code. While n8n offers a cloud-hosted version, many organizations and individuals choose to self-host the software on their own servers using Docker, npm, or virtual private servers. Self-hosting provides greater control over data and customization but shifts the responsibility for security entirely to the operator.

When a self-hosted instance is "exposed," it means the server is configured to accept connections from the public internet. If authentication is missing or weak, anyone can access the workflow editor, view stored credentials, and execute automations. Even with authentication, running outdated software leaves the system open to known exploits. Censys operates by continuously scanning the entire IPv4 address space, recording which ports are open and what services are responding, providing a real-time map of internet-facing assets.

Why it matters

For teams running their own software, this report serves as a stark reminder that default configurations are rarely secure enough for public-facing deployment. The high percentage of vulnerable instances suggests that many operators deploy n8n and forget to maintain it. In a self-hosted environment, there is no vendor automatically applying security patches. If your instance holds API keys for services like Gmail, Stripe, or GitHub, an attacker who gains access can compromise those external accounts as well.

The prevalence of non-standard ports among exposed services indicates a widespread reliance on security through obscurity. Engineers often change default ports believing it will hide their services from casual attackers. However, automated bots scan every port systematically. Relying on this tactic gives a false sense of security while leaving the underlying application vulnerable to exploitation if a critical flaw is discovered.

Furthermore, the rapid 63% growth in exposed AI infrastructure highlights an expanding attack surface. As more companies integrate AI tools into their internal workflows, the number of potential entry points for attackers increases. Without rigorous hardening practices, these tools become low-hanging fruit for automated attacks. The risk is not theoretical; it is a measurable, growing trend that affects thousands of organizations globally.

What you can do

• Verify exposure immediately: Use Censys search or run a curl command from an external network to check if your n8n instance is publicly reachable.
• Enforce authentication: Ensure basic auth or another login mechanism is active and force users to authenticate before accessing the editor.
• Implement TLS and reverse proxy: Use a tool like Caddy or Nginx to handle SSL certificates and terminate HTTPS traffic before it reaches your application.
• Patch regularly: Check your current version against the latest release and update immediately, especially if running a version from before October 2026.
• Restrict network access: Use firewalls to block direct access to the application port, allowing only traffic through the reverse proxy or via a VPN.
• Schedule recurring audits: Set a calendar reminder to re-check your exposure status and patch level quarterly, as new vulnerabilities emerge frequently.