CVE-2025-52554: n8n broken authz enables cross-user

CISO Take

Any authenticated n8n user can stop workflows they don't own — including production AI agent pipelines and automated security operations. Patch to v1.99.1 immediately; risk is highest in multi-tenant or shared n8n deployments. Until patched, restrict /rest/executions/:id/stop at the reverse proxy layer.

What is the risk?

CVSS 4.3 understates operational impact in AI-heavy environments. Exploitability is trivial — any valid session token suffices, no special knowledge required. Business risk scales with how critical the disrupted workflows are: in organizations using n8n to orchestrate AI agents, mid-execution stops can corrupt state, cause partial writes to external systems, or abort active incident response automations. Multi-tenant deployments are highest risk.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
193.4K OpenSSF 6.6 Pushed 3d ago 55% patched ~7d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

4 steps

Patch: Upgrade to n8n v1.99.1 immediately — this is the definitive fix.
Workaround: Block POST /rest/executions/:id/stop at reverse proxy or API gateway, restricting access to admin roles or trusted IP ranges only.
Audit: Review execution logs for stop events where the caller's userId differs from the execution owner — flag these as potential abuse.
Access control: Apply least-privilege n8n roles; avoid granting execution management permissions to general or read-only users.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Agent Framework AML.T0012 - Valid Accounts AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

8.4 - AI system operation and monitoring

NIST AI RMF

GOVERN 6.2 - Policies and procedures for AI accountability MANAGE 2.2 - AI risk controls and operational safeguards

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2025-52554?

Any authenticated n8n user can stop workflows they don't own — including production AI agent pipelines and automated security operations. Patch to v1.99.1 immediately; risk is highest in multi-tenant or shared n8n deployments. Until patched, restrict /rest/executions/:id/stop at the reverse proxy layer.

Is CVE-2025-52554 actively exploited?

No confirmed active exploitation of CVE-2025-52554 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-52554?

1. Patch: Upgrade to n8n v1.99.1 immediately — this is the definitive fix. 2. Workaround: Block POST /rest/executions/:id/stop at reverse proxy or API gateway, restricting access to admin roles or trusted IP ranges only. 3. Audit: Review execution logs for stop events where the caller's userId differs from the execution owner — flag these as potential abuse. 4. Access control: Apply least-privilege n8n roles; avoid granting execution management permissions to general or read-only users.

What systems are affected by CVE-2025-52554?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI orchestration pipelines, multi-agent systems, workflow automation, AI-driven security operations.

What is the CVSS score for CVE-2025-52554?

CVE-2025-52554 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI orchestration pipelinesmulti-agent systemsworkflow automationAI-driven security operations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: 8.4

NIST AI RMF: GOVERN 6.2, MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.

Exploitation Scenario

A disgruntled contractor with a low-privilege n8n account queries the executions list to enumerate active execution IDs. They identify a long-running AI pipeline — an automated threat intelligence aggregator running hourly — and send repeated POST requests to /rest/executions/<id>/stop using their own valid auth token. Each stop terminates the pipeline mid-execution, silently dropping threat indicators before they reach the SIEM. The attack is difficult to detect without execution audit logging because the stop action appears as a legitimate API call from a valid user.

Weaknesses (CWE)

CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.