Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-gq57-v332-7666
No affected components available
Summary
An authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption.
Impact
This is an improper authorization vulnerability. While most API methods enforce user-scoped access to workflow execution IDs, the /stop endpoint fails to do so. An attacker can guess or enumerate execution IDs (which are sequential and partially exposed via verbose error messages) and terminate active workflows initiated by other users.
Who is impacted:
- Environments where multiple users with varying trust levels share access to the same n8n instance.
- All users running long-running or time-sensitive workflows (e.g., using the
waitnode).
An attacker with authenticated access can exploit this flaw to:
- Disrupt other users’ workflow executions.
- Cause denial of service for business-critical automations.
Patches
The issue was addressed in https://github.com/n8n-io/n8n/pull/16405. Users should upgrade to version >= 1.99.1.
Users should upgrade to this version or later to ensure proper authorization checks are enforced before stopping workflow executions.
Workarounds
To mitigate this issue without upgrading:
- Restrict access to the
/rest/executions/:id/stopendpoint via reverse proxy or API gateway.
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a low impact on the integrity of the data.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard