CVE-2026-100609
MediumCVSS 6.8Summary
Flowise (npm packages flowise and flowise-components) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace in several code paths, including getAllOpenaiAssistants/getSingleOpenaiAssistant, uploadFilesToAssistant, deleteAssistant, and the shared helper used by getVoices. An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf.
Risk Assessment
An attacker can leverage API keys from other workspaces, leading to unauthorized access to external services and potential costs. This constitutes a breach of tenant isolation and credential confidentiality.
Recommendation
No patch is available — monitor vendor communications and apply it as soon as possible. Until the update, consider rotating API keys and restricting access to assistant endpoints.
Other vulnerabilities in Flowise
See all- CVE-2026-100610High
Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation.
- CVE-2026-100608High
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When running in queue mode with the dashboard enabled, any authenticated user can access /admin/queues.
- CVE-2026-100607High
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email.
- CVE-2026-100606High
Flowise through 3.1.4 contains an authentication bypass in the SSO login path when an SSO callback arrives with an email matching an INVITED user, allowing takeover of the invitation.
- CVE-2026-100605High
Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints, allowing low-privileged API keys to read and delete chat history.
- CVE-2026-52098Critical
An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint.
- CVE-2026-73602Critical
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.
- CVE-2026-73487Critical
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.
- CVE-2026-67622Critical
A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.
- CVE-2026-70478Critical
Flowise prior to 3.1.3 contains a vulnerability in the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is in WHITELIST_URLS and requires no authentication. An attacker with a credential ID can refresh the OAuth token and gain access to the victim's connected service, as well as exhaust refresh-token quota.
Original NVD description (English source)
Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS