CVE-2026-90534
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Flowise versions up to and including 3.1.3 mount the POST /api/v1/node-load-method/:name endpoint without any route-level permission check and invoke component loadMethods with attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace. An authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace, causing Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4.
Risk Assessment
A low-privilege attacker can leverage credentials from other workspaces to perform operations with third-party providers and obtain metadata, breaking workspace isolation and potentially leading to unauthorized data access.
Recommendation
Update Flowise to version 3.1.4 or later, which verifies the credential's workspaceId against the caller's workspace.
Other vulnerabilities in Flowise
See all- CVE-2026-52098Critical
An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint.
- CVE-2026-73602Critical
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.
- CVE-2026-73487Critical
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.
- CVE-2026-67622Critical
A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.
- CVE-2026-70478Critical
Flowise prior to 3.1.3 contains a vulnerability in the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is in WHITELIST_URLS and requires no authentication. An attacker with a credential ID can refresh the OAuth token and gain access to the victim's connected service, as well as exhaust refresh-token quota.
- CVE-2026-70477Critical
Flowise before version 3.1.3 contains a prompt injection vulnerability in the CSV Agent node, allowing a malicious Python script to bypass the blocklist validator and execute in an unsandboxed Pyodide environment. An attacker can leverage this to execute arbitrary code in the context of the service account.
- CVE-2026-70470Critical
Flowise prior to 3.1.3 contains a vulnerability in the Python code validator that can be bypassed with Unicode homoglyphs, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host.
- CVE-2026-69264Critical
Flowise prior to 3.1.3 contains a vulnerability in CSVAgent that allows an attacker to inject code into a Python template executed by Pyodide, enabling arbitrary OS command execution on the Flowise host. An unauthenticated request to the API can trigger remote code execution.
- CVE-2026-69263Critical
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.
- CVE-2026-69258Critical
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of any public chatflow, overwrite values such as chatId, sessionId, and chatHistory, and control values resolved through $flow.* template variables consumed by flow nodes. This issue is fixed in version 3.1.3.
Original NVD description (English source)
Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace, unlike other credential read paths which are workspace-scoped. As a result, an authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace and cause Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS