Loading vulnerability…
IDOR in Flowise OpenAI Assistants workspace credential lookup
CVE-2026-67622 is an insecure direct object reference vulnerability affecting Flowise through version 3.1.4 in the OpenAI Assistants integration. The flaw arises because Assistants-related endpoints accept a client-supplied credential UUID and the backend resolves that identifier through a global credential lookup without enforcing workspace ownership or workspace-scoped authorization. As a result, an authenticated user with assistants-related permissions can cause the application to use credentials associated with a different workspace by referencing another workspace’s credential identifier. The issue represents a multi-tenant isolation failure and authorization bypass in credential lookup logic. Successful exploitation allows cross-workspace access to assistant-related resources and operations, including enumeration of assistant metadata, retrieval of file and vector store listings, and file uploads performed under the victim workspace’s OpenAI Assistants credential context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables an authenticated attacker to cross tenant or cross workspace boundaries and operate against another workspace’s OpenAI Assistants resources. This can expose assistant metadata and associated file and vector store information, permit unauthorized uploads into the victim workspace context, and drive unauthorized API consumption against the victim’s linked OpenAI account. The vulnerability can therefore result in confidentiality loss, integrity impact on assistant-associated resources, and secondary financial impact through unauthorized billed API usage. In multi-tenant deployments, the flaw undermines workspace isolation and can materially compromise tenant separation.
If you can’t patch tonight, do this now.
Until a fixed release is deployed, restrict authenticated user permissions, especially assistants-related permissions, to the minimum necessary. Limit access to multi-tenant Flowise instances where possible, closely monitor for suspicious credential identifier enumeration and anomalous cross-workspace Assistants requests, and audit for unexpected assistant activity, unusual file or vector store operations, and unexplained OpenAI billing increases. If compromise is suspected, rotate impacted OpenAI API keys and review tenant separation controls.
Patch, then assume compromise.
Upgrade Flowise to a version later than 3.1.4 that corrects the credential lookup logic by enforcing workspace-scoped authorization checks before resolving and using Assistants credentials. The fix should ensure credential resolution is constrained to the caller’s active workspace and that all Assistants endpoints validate ownership or explicit authorization for referenced credential objects. After upgrading, review access logs and assistant-related activity for signs of cross-workspace access, and rotate affected OpenAI API credentials if unauthorized use is suspected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.