CVE-2026-70472: Flowise Auth Bypass Vulnerability

CVE-2026-70472 Overview

CVE-2026-70472 is a broken authorization vulnerability [CWE-285] in Flowise, a drag-and-drop interface for building large language model (LLM) workflows. Versions prior to 3.1.3 expose openai-assistants-vector-store endpoints that accept a client-controlled credential query parameter and load credentials by ID without validating workspace ownership. An attacker with a valid low-privilege session who knows another workspace's credentialId can hijack that workspace's OpenAI API key. The flaw breaks multi-tenant isolation and enables cross-tenant read, modify, or delete operations against victim vector stores.

Critical Impact
Attackers can abuse another workspace's OpenAI credentials to access vector stores and files, incur billing charges on the victim account, and violate multi-tenant boundaries.

Affected Products

Flowise versions prior to 3.1.3
FlowiseAI openai-assistants-vector-store API endpoints
Multi-tenant Flowise deployments hosting multiple workspaces

Discovery Timeline

2026-08-04 - CVE-2026-70472 published to NVD
2026-08-05 - Last updated in NVD database
Fix released - Flowise version 3.1.3 published via GitHub Release flowise@3.1.3

Technical Details for CVE-2026-70472

Vulnerability Analysis

The vulnerability resides in Flowise's openai-assistants-vector-store controller and service layer. The controller accepts req.query.credential from the caller and forwards it directly to the service without workspace scoping. Route middleware enforces assistants:* permissions, which only gate feature access rather than object ownership. The service then invokes findOneBy({ id: credentialId }), decrypts the credential, and issues OpenAI API calls under that identity. Because the lookup omits a workspaceId predicate, any authenticated user in any workspace can supply an arbitrary credential ID belonging to another tenant. The affected operations include listing, creating, reading, updating, and deleting vector stores and files tied to the compromised OpenAI account.

Root Cause

The root cause is missing authorization [CWE-285] on tenant-owned resources. Credential lookups rely solely on the primary key without joining or filtering on the caller's activeWorkspaceId. The permission model conflates feature entitlement with resource ownership, which is a common failure pattern in multi-tenant SaaS designs.

Attack Vector

Exploitation requires network access to the Flowise API and a low-privilege authenticated session. The attacker must obtain or guess a credentialId (a UUID) from another workspace, then submit it via the credential query parameter to any openai-assistants-vector-store endpoint. No user interaction is required from the victim.

typescript

// Security patch pattern from FlowiseAI/Flowise commit d81483b
// Before: workspace scoping omitted
const apiResponse = await chatflowsService.checkIfChatflowHasChanged(req.params.id, req.params.lastUpdatedDateTime)

// After: caller's active workspace is required and passed to the service
const workspaceId = req.user?.activeWorkspaceId
if (!workspaceId) {
    throw new InternalFlowiseError(
        StatusCodes.NOT_FOUND,
        'Error: chatflowsController.checkIfChatflowHasChanged - active workspace ID not found!'
    )
}
const apiResponse = await chatflowsService.checkIfChatflowHasChanged(req.params.id, req.params.lastUpdatedDateTime, workspaceId)

Source: GitHub Commit d81483b. The patch introduces activeWorkspaceId retrieval and workspace-scoped service methods such as getChatflowByIdForWorkspace.

Detection Methods for CVE-2026-70472

Indicators of Compromise

Requests to /api/v1/openai-assistants-vector-store/* containing a credential query parameter that resolves to a credential owned by a different workspace than the authenticated user.
Unexpected OpenAI API activity, vector store mutations, or file deletions on the victim OpenAI account with no matching workspace-side action.
Sudden increases in OpenAI billing tied to assistants or vector store operations that do not correlate with legitimate workspace usage.

Detection Strategies

Correlate authenticated user sessions with the credentialId values submitted to assistants endpoints and alert when the credential's owning workspace differs from the caller's activeWorkspaceId.
Enable Flowise application logging and forward access logs to a centralized platform such as Singularity Data Lake for cross-tenant query analytics.
Baseline OpenAI-side audit logs and flag deletions or bulk modifications of vector stores that originate from Flowise server IPs outside normal patterns.

Monitoring Recommendations

Monitor HTTP request bodies and query strings for the credential parameter on all openai-assistants-* routes.
Track OpenAI API cost anomalies per API key and alert on spend deviations exceeding tenant baselines.
Audit access to the Flowise credentials table and record every findOneBy invocation lacking a workspace filter.

How to Mitigate CVE-2026-70472

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later, which is the fixed release for this issue.
Rotate all OpenAI API keys stored as credentials in affected Flowise deployments, since any workspace tenant could have exfiltrated them.
Audit OpenAI vector stores, assistants, and files for unauthorized creation, modification, or deletion during the exposure window.

Patch Information

The fix is delivered in GitHub Release flowise@3.1.3 via Pull Request #6170 and commit d81483b. Full details are published in GitHub Security Advisory GHSA-chm3-vqcf-52rx. The patch introduces workspace-scoped service methods and requires req.user.activeWorkspaceId on affected controllers.

Workarounds

Restrict Flowise API access to trusted networks or a single tenant per instance until the upgrade is applied.
Add a reverse-proxy rule that blocks requests to openai-assistants-vector-store endpoints containing a credential query parameter.
Provision separate Flowise instances per workspace to eliminate cross-tenant credential exposure risk.

bash

# Upgrade Flowise to the patched release
npm install -g flowise@3.1.3

# Or for Docker deployments
docker pull flowiseai/flowise:3.1.3
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.3