CVE-2025-52554 — MEDIUM (CVSS 4.3) AI Security Vulnerability

CISO Take

Any authenticated n8n user can stop workflows they don't own — including production AI agent pipelines and automated security operations. Patch to v1.99.1 immediately; risk is highest in multi-tenant or shared n8n deployments. Until patched, restrict /rest/executions/:id/stop at the reverse proxy layer.

Risk Assessment

CVSS 4.3 understates operational impact in AI-heavy environments. Exploitability is trivial — any valid session token suffices, no special knowledge required. Business risk scales with how critical the disrupted workflows are: in organizations using n8n to orchestrate AI agents, mid-execution stops can corrupt state, cause partial writes to external systems, or abort active incident response automations. Multi-tenant deployments are highest risk.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
186.5K OpenSSF 6.0 16 dependents Pushed 7d ago 40% patched ~3d to patch Full package profile →

Do you use n8n? You're affected.

Severity & Risk

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 56% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

Attack Surface

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A None

Recommended Action

4 steps

Patch: Upgrade to n8n v1.99.1 immediately — this is the definitive fix.
Workaround: Block POST /rest/executions/:id/stop at reverse proxy or API gateway, restricting access to admin roles or trusted IP ranges only.
Audit: Review execution logs for stop events where the caller's userId differs from the execution owner — flag these as potential abuse.
Access control: Apply least-privilege n8n roles; avoid granting execution management permissions to general or read-only users.

CISA SSVC Assessment

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Auth Bypass DoS Agent Framework AML.T0012 - Valid Accounts AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation

Compliance Impact

This CVE is relevant to:

ISO 42001

8.4 - AI system operation and monitoring

NIST AI RMF

GOVERN 6.2 - Policies and procedures for AI accountability MANAGE 2.2 - AI risk controls and operational safeguards

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2025-52554?

Any authenticated n8n user can stop workflows they don't own — including production AI agent pipelines and automated security operations. Patch to v1.99.1 immediately; risk is highest in multi-tenant or shared n8n deployments. Until patched, restrict /rest/executions/:id/stop at the reverse proxy layer.

Is CVE-2025-52554 actively exploited?

No confirmed active exploitation of CVE-2025-52554 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-52554?

1. Patch: Upgrade to n8n v1.99.1 immediately — this is the definitive fix. 2. Workaround: Block POST /rest/executions/:id/stop at reverse proxy or API gateway, restricting access to admin roles or trusted IP ranges only. 3. Audit: Review execution logs for stop events where the caller's userId differs from the execution owner — flag these as potential abuse. 4. Access control: Apply least-privilege n8n roles; avoid granting execution management permissions to general or read-only users.

What systems are affected by CVE-2025-52554?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI orchestration pipelines, multi-agent systems, workflow automation, AI-driven security operations.

What is the CVSS score for CVE-2025-52554?

CVE-2025-52554 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.33%.

Technical Details

NVD Description

n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.

Exploitation Scenario

A disgruntled contractor with a low-privilege n8n account queries the executions list to enumerate active execution IDs. They identify a long-running AI pipeline — an automated threat intelligence aggregator running hourly — and send repeated POST requests to /rest/executions/<id>/stop using their own valid auth token. Each stop terminates the pipeline mid-execution, silently dropping threat indicators before they reach the SIEM. The attack is difficult to detect without execution audit logging because the stop action appears as a legitimate API call from a valid user.