CVE-2026-46478 Overview
CVE-2026-46478 is a mass-assignment vulnerability in Flowise, an open-source drag-and-drop interface for building large language model (LLM) workflows. The flaw exists in the DatasetRow create and update operations prior to version 3.1.2. An authenticated attacker can supply unintended object properties during these operations to take over dataset rows belonging to other workspaces. This breaks the tenant isolation model that Flowise enforces between workspaces. The issue is tracked as [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes]. The maintainers patched the issue in Flowise 3.1.2.
Critical Impact
An authenticated low-privilege user can modify or assume ownership of DatasetRow records across workspace boundaries, compromising the confidentiality and integrity of LLM training and evaluation data.
Affected Products
- FlowiseAI Flowise versions prior to 3.1.2
- Self-hosted Flowise deployments exposing the dataset management API
- Multi-tenant Flowise instances using workspace-based isolation
Discovery Timeline
- 2026-06-08 - CVE-2026-46478 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-46478
Vulnerability Analysis
The vulnerability resides in the DatasetRow create and update handlers within Flowise. These handlers accept a client-supplied object and persist its fields directly to the underlying record without filtering attributes that should be server-controlled. Mass-assignment patterns of this kind allow callers to set sensitive fields such as workspace identifiers or ownership references that the application logic assumes are immutable. By including these fields in a request body, an authenticated user can write to or reassign DatasetRow entries scoped to a different workspace.
Flowise datasets store the prompts, expected outputs, and evaluation samples used to test and tune LLM flows. Cross-workspace row takeover lets an attacker read sensitive prompt data, inject poisoned evaluation samples, or silently alter the ground-truth used by other tenants. In shared SaaS-style deployments, this collapses the workspace boundary that customers rely on for data segregation.
Root Cause
The root cause is the absence of an allowlist on writable properties in the DatasetRow create and update flows. The handlers trust the inbound payload and bind all submitted attributes to the persisted entity. Workspace ownership fields are not validated against the caller's session context, so attacker-controlled values overwrite the server-assigned ones.
Attack Vector
Exploitation requires network access to the Flowise API and valid credentials with permission to create or update dataset rows in any workspace. The attacker sends a crafted JSON body to the DatasetRow create or update endpoint that includes extra fields targeting another workspace's row identifier or workspace association. No user interaction is required, and the attack complexity is low. Details are described in the GitHub Security Advisory GHSA-7j65-65cr-6644.
Detection Methods for CVE-2026-46478
Indicators of Compromise
- API requests to DatasetRow create or update endpoints containing fields such as workspaceId, id, or ownership references that the legitimate UI does not submit.
- DatasetRow records whose workspaceId no longer matches the parent Dataset workspace association.
- Unexpected modifications to dataset evaluation rows immediately following authentication events from low-privilege accounts.
Detection Strategies
- Review Flowise application logs for POST and PUT requests to dataset row routes with payloads containing keys outside the documented schema.
- Run database integrity queries that join DatasetRow to its parent Dataset and flag any rows where the workspace association is inconsistent.
- Correlate dataset row modification events with the authenticated user's workspace membership to surface cross-workspace writes.
Monitoring Recommendations
- Enable verbose audit logging on Flowise dataset endpoints and forward logs to a centralized analytics platform.
- Alert on any single user account that creates or updates dataset rows associated with more than one workspace within a short interval.
- Monitor for sudden changes in dataset row content used by production LLM evaluation pipelines.
How to Mitigate CVE-2026-46478
Immediate Actions Required
- Upgrade Flowise to version 3.1.2 or later, as published in the Flowise 3.1.2 release notes.
- Audit existing DatasetRow records for cross-workspace inconsistencies before and after upgrading.
- Rotate API keys and session tokens for any account suspected of abusing the dataset row endpoints.
Patch Information
The FlowiseAI maintainers fixed CVE-2026-46478 in Flowise 3.1.2. The patch restricts writable attributes on DatasetRow create and update operations so that workspace and ownership fields cannot be set from request payloads. Refer to the GitHub Security Advisory GHSA-7j65-65cr-6644 for the upstream fix details.
Workarounds
- Restrict access to the Flowise instance to trusted networks until the upgrade is completed.
- Limit dataset create and update permissions to a minimal set of administrative accounts.
- Place an API gateway or reverse proxy in front of Flowise that strips unexpected JSON fields from dataset row requests.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
