Loading story…
A critical insecure direct object reference flaw, tracked as CVE-2026-67622, affects Flowise through version 3.1.4 and allows authenticated users to access resources tied to other workspaces in multi-tenant deployments. The bug resides in the OpenAI Assistants integration, where assistants-related endpoints accept an arbitrary credential UUID and resolve it without verifying that the credential belongs to the caller’s active workspace. The vulnerability is classified as CWE-639 and has been rated CVSS 9.9 under v3.1, with reporting also citing a CVSS 4.0 score of 8.5.
By supplying another workspace’s credential UUID, an attacker can cause Flowise to use a victim workspace’s OpenAI Assistants credential, enabling cross-workspace access to assistant metadata, file listings, and vector stores, and allowing file uploads into victim workspaces. The flaw also creates a path to unauthorized OpenAI API consumption and potential billing impact on affected accounts. Public reporting said no active exploitation had been observed at publication, and a vendor fix was expected in a future Flowise release.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record states that the new CVE was received by disclosure@vulncheck.com on August 6, 2026.
On August 6, 2026, CVE-2026-67622 was published for Flowise through version 3.1.4, describing cross-workspace credential access, assistant metadata exposure, file and vector store listing access, and file upload impact in the OpenAI Assistants integration.
VulnCheck reported a missing authorization vulnerability in Flowise 2.2.4 through 3.1.4 affecting the POST /api/v1/openai-assistants-file/download endpoint. Because the endpoint was placed on the global authentication whitelist, unauthenticated attackers can bypass session and API key checks and retrieve private files from any chatflow if they know valid identifiers.
Security researchers CayCon and piropatriot discovered CVE-2026-67622, an IDOR flaw in Flowise's OpenAI Assistants integration that lets authenticated users supply another workspace's credential UUID without workspace ownership checks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
vulncheck.com
Open sourcethreataft.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Flowise fixed two closely related flaws in its OAuth2 credential refresh functionality that allowed unauthenticated access to `POST /api/v1/oauth2-credential/refresh/:credentialId`. In versions before 3.1.3, tracked as **CVE-2026-70478**, the endpoint was placed in `WHITELIST_URLS` without authentication, letting an attacker who knew a credential ID decrypt stored OAuth details, trigger a refresh with the provider, and receive the new access token in the response. The issue exposed connected third-party services to token theft and could also be abused to consume refresh-token quotas. A follow-on bug, **CVE-2026-70636**, showed the earlier fix was incomplete and that Flowise through 3.1.4 still allowed authentication bypass through prefix-based whitelist matching. Researchers reported that crafted requests with a trailing credential identifier could still reach the refresh handler, which refreshed and updated OAuth credentials without validating caller identity, workspace ownership, or RBAC permissions. The flaw enabled cross-workspace token rotation and unauthorized mutation of credential state, and was described as a bypass of an earlier remediation tied to `GHSA-6f7g-v4pp-r667`.
Aug 7, 2026
A critical vulnerability tracked as **CVE-2026-56271** allows remote attackers to bypass authentication in **Flowise** by forging valid JWTs and impersonating arbitrary users, including administrators. The flaw affects versions before **3.1.0**, including **3.0.13** and earlier, and stems from weak hardcoded default JWT secrets plus default audience and issuer values in the enterprise passport authentication middleware. When the relevant JWT environment variables are not explicitly configured, Flowise falls back to publicly known defaults, effectively embedding insecure default credentials into the authentication path. The issue is rated **CVSS v3.1 9.8** and **CVSS v4.0 9.3** as remotely exploitable, and remediation guidance calls for upgrading to **Flowise 3.1.0 or later** and setting strong, unique JWT secrets along with custom audience and issuer values.
Jul 18, 2026
Threat actors are actively exploiting **CVE-2025-59528**, a **CVSS 10.0** remote code execution flaw in the open-source AI platform **Flowise**. The bug affects Flowise versions through **3.0.5** and stems from the `CustomMCP` node unsafely passing user-controlled input into JavaScript execution, allowing attackers with an API token to run arbitrary code with full **Node.js** runtime privileges. Researchers said the issue can be triggered remotely via a crafted HTTP `POST` request without user interaction, leading to operating system command execution, filesystem access, sensitive data theft, and full system compromise. Security researchers observed in-the-wild exploitation originating from a single **Starlink IP address**, while warning that roughly **12,000 to 15,000** internet-exposed Flowise instances sharply expand the attack surface for opportunistic attacks. Flowise disclosed the vulnerability in 2025, credited researcher **Kim SooHyun**, and patched the flaw in **version 3.0.6**. The incident marks the third Flowise vulnerability reported as exploited in the wild after **CVE-2025-8943** and **CVE-2025-26319**, increasing pressure on organizations to upgrade immediately and limit public exposure of Flowise APIs.
Jun 29, 2026