CVE-2026-46444: Flowiseai Flowise Auth Bypass Vulnerability

CVE-2026-46444 Overview

CVE-2026-46444 is a missing authorization vulnerability [CWE-862] in Flowise, a drag-and-drop interface for building large language model (LLM) workflows. Versions prior to 3.1.2 expose all CRUD endpoints under /api/v1/openai-assistants-vector-store without authentication middleware or permission checks. The route is not included in WHITELIST_URLS and requires an API key, yet no authorization logic validates what the caller can do. Any user holding a valid API key can read, modify, or delete OpenAI Assistants vector store resources belonging to other tenants. FlowiseAI patched the issue in version 3.1.2.

Critical Impact
An authenticated user with any valid API key can perform unrestricted CRUD operations on OpenAI Assistants Vector Store objects, exposing or destroying data tied to other users' LLM assistants.

Affected Products

FlowiseAI Flowise versions prior to 3.1.2
Deployments exposing /api/v1/openai-assistants-vector-store to networked clients
Multi-tenant Flowise installations sharing API key authentication

Discovery Timeline

2026-06-08 - CVE-2026-46444 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-46444

Vulnerability Analysis

Flowise routes API traffic through a primary authentication middleware that enforces API key validation and a WHITELIST_URLS array that excludes public endpoints. The /api/v1/openai-assistants-vector-store route sits outside this protection model. Requests succeed when an API key is presented, but no per-resource ownership or role check is executed before the handler runs.

The handler exposes Create, Read, Update, and Delete operations against OpenAI Assistants Vector Store records. Any caller can enumerate vector store IDs and operate on them regardless of which Flowise user originally provisioned the assistant. In multi-tenant deployments, this collapses the authorization boundary between API key holders.

Impact spans confidentiality, integrity, and availability. Attackers can exfiltrate vector store metadata referencing proprietary embeddings, tamper with the assistant configuration, or destroy stored vector references and break downstream LLM workflows.

Root Cause

The defect is a broken access control pattern [CWE-862]. The route was neither whitelisted as public nor wired into the permission enforcement layer applied to other authenticated endpoints. The result is authenticated-but-unauthorized access — authentication succeeds, but authorization is never evaluated.

Attack Vector

Exploitation requires network reachability to the Flowise API and a low-privilege API key. The attacker issues standard HTTP requests to the vector store CRUD endpoints. Because no permission check distinguishes the caller from the resource owner, the requests succeed against any record the attacker references. No user interaction is required.

No public proof-of-concept or exploit is currently listed for CVE-2026-46444, and it is not on the CISA Known Exploited Vulnerabilities catalog. See the GitHub Security Advisory GHSA-hmg2-jjjx-jcp2 for vendor-provided technical detail.

Detection Methods for CVE-2026-46444

Indicators of Compromise

HTTP requests to /api/v1/openai-assistants-vector-store and its sub-paths from API keys that do not own the targeted resources
Unexpected DELETE or PUT operations against vector store IDs in Flowise application logs
Vector store records modified or removed without a corresponding action by the resource owner

Detection Strategies

Audit reverse proxy and Flowise access logs for GET, POST, PUT, and DELETE traffic against /api/v1/openai-assistants-vector-store predating the upgrade to 3.1.2
Correlate API key identifiers with the user ID associated with each accessed vector store and flag mismatches
Alert on bulk enumeration patterns against the vector store endpoint, such as sequential ID access from a single key

Monitoring Recommendations

Forward Flowise application and web server logs to a centralized analytics platform for retention and search
Baseline normal vector store CRUD volume per API key and alert on deviations
Monitor the Flowise process for unexpected outbound calls to OpenAI APIs that may indicate tampered assistant configurations

How to Mitigate CVE-2026-46444

Immediate Actions Required

Upgrade Flowise to version 3.1.2 or later, which adds authentication and permission checks to the affected route
Rotate all Flowise API keys after upgrading to invalidate any keys that may have been abused
Restrict network exposure of the Flowise API to trusted internal networks or authenticated reverse proxies until the patch is applied

Patch Information

FlowiseAI released the fix in Flowise 3.1.2. The release adds the missing authorization enforcement on /api/v1/openai-assistants-vector-store CRUD handlers. Refer to the GitHub Security Advisory GHSA-hmg2-jjjx-jcp2 for the full advisory.

Workarounds

Place Flowise behind a reverse proxy that denies external requests to /api/v1/openai-assistants-vector-store until version 3.1.2 is deployed
Limit issuance of Flowise API keys to a minimal set of trusted operators while the patch is staged
Disable use of OpenAI Assistants Vector Store features in Flowise where the functionality is not required

bash

# Example NGINX block restricting the vulnerable route prior to upgrade
location /api/v1/openai-assistants-vector-store {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://flowise_backend;
}