EUVD-2026-35109
GHSA-hp26-q66v-q2w7
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.
AnalysisAI
Cross-workspace tenant isolation bypass in FlowiseAI versions prior to 3.1.2 allows authenticated low-privileged users to reassign assistant resources to arbitrary workspaces by manipulating server-controlled fields in the assistant update endpoint. The flaw is a mass assignment issue (CWE-284) tracked as EUVD-2026-35109, with publicly available exploit code exists via the GHSA advisory PoC, though no public exploit identified at time of analysis as widely deployed exploitation. SSVC indicates total technical impact but non-automatable exploitation.
Technical ContextAI
Flowise is an open-source drag-and-drop interface for building LLM application flows, distributed via npm as the 'flowise' package. The vulnerability resides in the PUT /api/v1/assistants/{assistantId} endpoint, which deserializes the JSON request body directly into the underlying database entity without DTO whitelisting, allowance lists, or authorization checks on protected fields. CWE-284 (Improper Access Control) manifests here as a classic mass assignment / over-posting flaw: server-controlled attributes such as workspaceId, createdDate, and updatedDate are exposed to client mutation. In multi-workspace deployments, workspaceId is the primary tenant boundary, so allowing client-supplied values for it collapses the multi-tenant security model. The affected CPE is cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:* covering all versions up to and including 3.1.1.
RemediationAI
Upgrade to vendor-released patch Flowise 3.1.2 or later, available at https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2, which adds server-side DTO whitelisting and authorization checks on the assistant update endpoint along with related mass-assignment fixes in tools, variables, and user endpoints. If immediate upgrade is not feasible, place a reverse proxy or API gateway in front of Flowise that strips workspaceId, createdDate, and updatedDate fields from PUT /api/v1/assistants/* request bodies - this preserves legitimate update functionality but blocks the specific abuse, at the cost of maintaining a custom filter that must be revisited when the schema changes. Additionally restrict who can authenticate to Flowise (network ACLs, SSO enforcement) and audit existing assistants for unexpected workspaceId values, since the SSVC Exploitation rating of 'poc' confirms working exploit details are public in the GHSA advisory.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTO
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today