CVE-2026-46479 Overview
CVE-2026-46479 is a mass-assignment vulnerability in Flowise, a drag-and-drop interface for building large language model (LLM) workflows. The flaw resides in the evaluation create and update endpoints prior to version 3.1.2. Authenticated users can supply unintended fields during evaluation operations, allowing cross-workspace evaluation takeover. The vulnerability is classified under CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes. FlowiseAI patched the issue in version 3.1.2.
Critical Impact
An authenticated attacker with low privileges can take over evaluations belonging to other workspaces, compromising confidentiality, integrity, and availability of LLM evaluation data across tenant boundaries.
Affected Products
- Flowise versions prior to 3.1.2
- FlowiseAI evaluation create endpoint
- FlowiseAI evaluation update endpoint
Discovery Timeline
- 2026-06-08 - CVE-2026-46479 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-46479
Vulnerability Analysis
Flowise exposes evaluation create and update endpoints that accept JSON payloads describing evaluation metadata. The endpoints bind incoming request fields directly to the underlying evaluation model without filtering attributes that should be controlled by the server. This pattern, known as mass-assignment, lets a caller set sensitive fields such as workspace identifiers or ownership references. An authenticated user in one workspace can craft a request that overwrites an evaluation owned by another workspace.
Flowise is commonly deployed in multi-tenant environments where teams build and test LLM pipelines side by side. Cross-workspace takeover breaks the tenant isolation model the platform is expected to enforce. An attacker can read, modify, or destroy evaluations they should not access, including prompt test cases, scoring rubrics, and result history.
Root Cause
The root cause is the absence of an allowlist on writable fields during evaluation create and update operations. The server trusts the client payload to define the object shape rather than restricting fields to those the caller is authorized to set. Workspace ownership attributes are mutable through the same path as benign properties, eliminating the boundary between tenants.
Attack Vector
The attack vector is network-based and requires low privileges. An authenticated user submits a crafted HTTP request to the evaluation create or update API with additional fields targeting another workspace. No user interaction is required. The attacker leverages a legitimate session against the same Flowise instance to manipulate evaluations outside their tenant scope. Refer to the GitHub Security Advisory GHSA-mq53-pc65-wjc4 for further detail.
Detection Methods for CVE-2026-46479
Indicators of Compromise
- Evaluation records whose workspaceId or ownership fields changed without a corresponding administrative action in audit logs.
- HTTP requests to evaluation create or update endpoints containing fields beyond the documented schema, such as identifiers, owner references, or timestamps.
- Authenticated API calls originating from one workspace that reference evaluation IDs belonging to another workspace.
Detection Strategies
- Compare evaluation ownership snapshots against expected workspace membership and alert on mismatches.
- Inspect application logs for evaluation API requests that include unexpected JSON properties and correlate them with the requesting user's workspace.
- Review version metadata on Flowise deployments and flag any instance running below 3.1.2.
Monitoring Recommendations
- Forward Flowise application and reverse proxy logs to a centralized log platform with retention sufficient to investigate cross-tenant access.
- Establish baselines for evaluation create and update volume per workspace and alert on spikes that may indicate enumeration.
- Monitor administrative actions on evaluation objects and require change tickets for ownership transfers.
How to Mitigate CVE-2026-46479
Immediate Actions Required
- Upgrade Flowise to version 3.1.2 or later using the official GitHub Release v3.1.2.
- Audit existing evaluations for unexpected workspace assignment or ownership changes and restore from backups where tampering is suspected.
- Rotate API tokens and session credentials for users who may have abused the endpoints.
Patch Information
FlowiseAI fixed the vulnerability in version 3.1.2. The patch restricts the fields that the evaluation create and update handlers accept, blocking mass-assignment of workspace ownership attributes. Release details are documented in the Flowise 3.1.2 release notes and the GHSA-mq53-pc65-wjc4 advisory.
Workarounds
- If immediate upgrade is not possible, restrict access to the Flowise instance to a limited set of trusted users and isolate workspaces across separate deployments.
- Place an API gateway or reverse proxy in front of Flowise to strip unexpected fields from evaluation create and update payloads.
- Disable shared multi-tenant use of the affected instance until version 3.1.2 is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
