CVE-2026-46477 Overview
CVE-2026-46477 is a mass-assignment vulnerability in Flowise, a drag-and-drop user interface for building customized large language model (LLM) flows. Versions prior to 3.1.2 allow authenticated users to manipulate dataset create and update operations by injecting attributes that should not be client-controlled. The flaw permits cross-workspace dataset takeover, breaking the tenancy boundary that isolates workspaces within a single Flowise deployment. FlowiseAI patched the issue in release 3.1.2. The weakness is tracked as CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes.
Critical Impact
An authenticated low-privilege user can hijack datasets owned by other workspaces, leading to unauthorized read, modification, and deletion of LLM training and evaluation data.
Affected Products
- FlowiseAI Flowise versions prior to 3.1.2
- Self-hosted Flowise deployments exposing dataset create and update endpoints
- Multi-workspace Flowise environments relying on workspace-level isolation
Discovery Timeline
- 2026-06-08 - CVE-2026-46477 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-46477
Vulnerability Analysis
Flowise exposes REST endpoints for creating and updating datasets used to evaluate and tune LLM flows. The handlers bind incoming JSON payloads directly to backend dataset objects without filtering which fields a client is allowed to set. This pattern, known as mass assignment, lets a caller include attributes such as workspace identifiers or ownership references in the request body. The server accepts these attributes and persists them, overriding values that should be derived from the authenticated session.
Because workspace ownership is determined by a field the client can supply, an attacker in one workspace can write a dataset record whose owning workspace points at a different tenant. Subsequent reads, updates, or deletes against that dataset succeed under the attacker's session, producing a cross-workspace takeover. The advisory GHSA-5h9v-837x-m97r confirms both create and update flows are affected.
Root Cause
The root cause is the absence of an allow-list for client-controllable fields on the dataset model. Sensitive attributes including the workspace association are merged from the request body into the persisted entity. Authorization checks rely on the submitted workspace value rather than the workspace bound to the authenticated session.
Attack Vector
Exploitation requires network access to the Flowise API and valid credentials for any workspace on the target instance. The attacker submits a crafted JSON body to the dataset create or update endpoint, adding fields that reassign ownership to a victim workspace. No user interaction is required. Refer to the FlowiseAI security advisory for the patched fields and request shape.
Detection Methods for CVE-2026-46477
Indicators of Compromise
- Dataset create or update HTTP requests containing workspace, owner, or tenant identifiers in the JSON body that differ from the caller's session workspace.
- Audit log entries showing dataset ownership transitions between workspaces without an administrative action.
- Unexpected dataset records appearing in a workspace whose authoring user belongs to a different workspace.
Detection Strategies
- Inspect application logs for POST and PUT requests to Flowise /api/v1/datasets paths and compare request-body workspace fields with the authenticated session workspace.
- Add server-side logging that records the resolved workspace identifier alongside the requested one to surface mismatches.
- Hunt for sequential calls in which a user creates a dataset and then reads or modifies datasets that previously belonged to another workspace.
Monitoring Recommendations
- Forward Flowise application and reverse-proxy logs to a centralized analytics platform and alert on cross-workspace dataset access.
- Track the Flowise version banner on every deployment to confirm upgrades to 3.1.2 or later.
- Review dataset ownership integrity on a recurring schedule, particularly in multi-tenant Flowise installations.
How to Mitigate CVE-2026-46477
Immediate Actions Required
- Upgrade Flowise to version 3.1.2 or later, available from the Flowise 3.1.2 release notes.
- Audit existing datasets for unexpected workspace ownership and restore correct assignments where tampering is found.
- Rotate API keys and session tokens for any workspace that may have been accessed by an untrusted user.
Patch Information
FlowiseAI released the fix in Flowise 3.1.2. The patch restricts which dataset attributes clients can set and binds workspace ownership to the authenticated session rather than to user-supplied request fields. Details are published in GitHub Security Advisory GHSA-5h9v-837x-m97r.
Workarounds
- Restrict access to the Flowise dataset endpoints to trusted administrators until the upgrade to 3.1.2 is completed.
- Place Flowise behind a reverse proxy or API gateway that strips workspace, owner, and tenant identifiers from inbound dataset request bodies.
- Limit Flowise account provisioning so that only vetted users hold credentials on shared multi-workspace instances.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
