Flowiseai

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-91934	Flowise self-hosted instances before 3.1.4 fail to validate the SQLite file path supplied to the SQL Database Chain node, letting any user who can create or edit a chatflow write arbitrary files on the host as the Node.js process. Because the connector creates a database file at whatever path it is given, a traversed path such as ../../ can place attacker-controlled SQLite databases, scripts, or HTML/JS payloads into system directories or the web root, escalating to command execution or stored XSS. The vendor has released a fix in 3.1.4, and no public exploit code or CISA KEV entry is identified in the supplied intelligence (authenticated, network-reachable exploitation per the CVSS 4.0 vector: PR:L, AV:N).	HIGH	8.7	–	44
CVE-2026-91935	Server-side request forgery in Flowise (an open-source low-code LLM/chatflow orchestration platform) before 3.1.4 lets an authenticated user point the baseURL parameter of a chat-model node at an arbitrary host, causing the Flowise server itself to issue the outbound request. Because stored LLM provider API keys are attached to those requests, an attacker holding the chatflows:create or chatflows:update permission can harvest credentials by redirecting traffic to cloud instance-metadata endpoints (e.g. 169.254.169.254) or internal services reachable from the Flowise host. The issue is fixed in 3.1.4; no CISA KEV entry, EPSS score, or public exploit code was supplied in the source data.	HIGH	8.7	–	44
CVE-2026-91937	An unauthenticated NoSQL injection in Flowise before 3.1.4 lets remote attackers read other users' chat history by abusing the overrideConfig.sessionId parameter handled by the MongoDBMemory node. The parameter is passed into MongoDB queries without sanitization, so submitting MongoDB operator objects (e.g. $ne, $regex, $gt) through the prediction API causes the query to match records belonging to other users in the shared chat collection. Only confidentiality is affected (CVSS 4.0 base 8.7, VC:H, no integrity or availability impact); no CISA KEV listing, EPSS score, or public exploit code was provided at time of analysis, and vendor patch status is 'available' with version 3.1.4 as the fix.	HIGH	8.7	–	44
CVE-2026-91936	Flowise releases prior to 3.1.4 ship GitHub Actions workflows that interpolate workflow_dispatch inputs such as tag_version and node_version directly into shell run blocks, allowing OS command injection during Docker image builds. The flaw is reachable only by a user who already holds write access to the repository (CVSS 4.0 PR:H), but the payoff is large: arbitrary command execution on the build runner with access to AWS credentials and Docker Hub tokens. No public exploit code or CISA KEV entry was reported at time of analysis, and the vendor has published a fix in 3.1.4 via GitHub Security Advisory GHSA-jrcq-qjw5-xx5q; note that this is a supply-chain/CI risk to the project's own build pipeline and to forks that reuse these workflows, not a runtime flaw in deployed Flowise instances.	HIGH	8.3	–	42
CVE-2026-91930	Authenticated users of Flowise before 3.1.4 can escalate to organization owner across tenant boundaries by supplying arbitrary organization IDs to the organizationuser and workspace membership endpoints, because those APIs are not scoped to the caller's own tenant. The result is full administrative control over victim organizations, including the ability to create workspaces and reach the victim tenant's resources. No public exploit code or CISA KEV listing was present in the source data, but the flaw is trivially automatable once an attacker holds any valid account, and vendor patch 3.1.4 is available.	HIGH	7.7	–	38
CVE-2026-91929	Cross-tenant authorization bypass in Flowise Enterprise endpoints (all versions before 3.1.4) allows an authenticated Enterprise user to operate on resources owned by other organizations — deleting arbitrary workspaces, inviting themselves into other tenants, modifying cross-organization roles, and reading or abusing stored SSO secrets. The root cause is CWE-862 (missing authorization): affected endpoints act on caller-supplied resource identifiers without verifying tenant ownership. Rated CVSS 7.6 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L), reachable over the network but requiring low-privileged Enterprise access; a vendor patch is available in 3.1.4, and no public exploit has been identified at time of analysis.	HIGH	7.6	–	38
CVE-2026-91933	Broken object-level authorization in Flowise's openai-realtime endpoints lets any authenticated user read tool definitions and execute tools belonging to ChatFlows in other workspaces by supplying an unscoped chatflowid, with both GET and POST requests affected. The flaw is fixed in Flowise 3.1.4 and affects all earlier releases; it is tracked as CWE-639 (authorization bypass through user-controlled key). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not supplied with this record, so risk should be judged from the authenticated-but-cross-tenant access model rather than from observed exploitation.	HIGH	7.6	–	38
CVE-2026-91938	Server-side request forgery in Flowise versions before 3.1.4 allows a low-privileged authenticated user to supply arbitrary URLs to the Cheerio, Playwright, and Puppeteer document loader nodes, bypassing the platform's built-in SSRF protections. Because the fetched response body is returned as document text, the flaw is a full-read SSRF rather than a blind one, exposing cloud instance metadata, internal-only services, and private network resources to the attacker. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation is currently unconfirmed; the vendor has released a patch in 3.1.4.	HIGH	7.6	–	38
CVE-2026-90535	Unauthenticated service disruption in Flowise before 3.1.4 allows any network attacker to forcibly abort active chatflow predictions belonging to other users. The /api/v1/text-to-speech/abort endpoint accepts caller-supplied chatflowId and chatId without verifying ownership, enabling targeted interruption of in-progress AI workflow sessions. No active exploitation (KEV) or public exploit code is confirmed at time of analysis; the attack is trivially low-complexity but requires a running target session and knowledge of valid identifiers.	MEDIUM	6.3	0.2%	32
CVE-2026-90534	Cross-workspace credential IDOR in Flowise versions up to and including 3.1.3 allows an authenticated low-privilege user in one workspace to invoke third-party provider API calls using credential secrets belonging to a different workspace. The POST /api/v1/node-load-method/:name endpoint is mounted without route-level permission checks and resolves credentials by raw database ID via getCredentialData() without verifying that the credential's workspaceId matches the caller's active workspace - a check that all other credential-read paths in Flowise correctly enforce. Statically confirmed affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables; the raw decrypted credential secret is not returned to the attacker, but provider-returned resource metadata is. Fixed in version 3.1.4; no public exploit identified at time of analysis.	MEDIUM	6.1	0.2%	31
CVE-2026-90580	Server-side request forgery in FlowiseAI Flowise up to version 3.0.2 allows authenticated users to redirect internal server-side HTTP requests by supplying attacker-controlled Host and X-Forwarded-Proto headers to the Evaluations endpoint, causing the server to construct the axios.post base URL from untrusted input rather than a trusted server-side value. The flaw enables the Flowise server to be leveraged as a proxy for reaching internal network resources, cloud metadata services, or adjacent microservices invisible to the external attacker. A publicly available proof-of-concept exists (GitHub issue #6687), and vendor-released patch 3.1.3 is available, though all affected versions (≤3.0.2) have been designated end-of-life by the maintainer.	LOW	2.1	0.2%	31	PoC
CVE-2026-90533	Broken access control in Flowise before 3.1.4 exposes organization owners' bcrypt password hashes and temporary tokens to any authenticated organization member via the GET /api/v1/organizationuser endpoint. The endpoint authenticates callers but performs no authorization check, allowing a low-privilege member to query any user ID and retrieve the owner's full user record - including stored credential hashes - enabling offline password cracking and subsequent full administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis; VulnCheck reported the issue with a fix confirmed in version 3.1.4.	MEDIUM	6.0	0.2%	30

CVE-2026-91934

Flowise self-hosted instances before 3.1.4 fail to validate the SQLite file path supplied to the SQL Database Chain node, letting any user who can create or edit a chatflow write arbitrary files on the host as the Node.js process. Because the connector creates a database file at whatever path it is given, a traversed path such as ../../ can place attacker-controlled SQLite databases, scripts, or HTML/JS payloads into system directories or the web root, escalating to command execution or stored XSS. The vendor has released a fix in 3.1.4, and no public exploit code or CISA KEV entry is identified in the supplied intelligence (authenticated, network-reachable exploitation per the CVSS 4.0 vector: PR:L, AV:N).

HIGH

8.7

–

44

CVE-2026-91935

Server-side request forgery in Flowise (an open-source low-code LLM/chatflow orchestration platform) before 3.1.4 lets an authenticated user point the baseURL parameter of a chat-model node at an arbitrary host, causing the Flowise server itself to issue the outbound request. Because stored LLM provider API keys are attached to those requests, an attacker holding the chatflows:create or chatflows:update permission can harvest credentials by redirecting traffic to cloud instance-metadata endpoints (e.g. 169.254.169.254) or internal services reachable from the Flowise host. The issue is fixed in 3.1.4; no CISA KEV entry, EPSS score, or public exploit code was supplied in the source data.

HIGH

8.7

–

44

CVE-2026-91937

An unauthenticated NoSQL injection in Flowise before 3.1.4 lets remote attackers read other users' chat history by abusing the overrideConfig.sessionId parameter handled by the MongoDBMemory node. The parameter is passed into MongoDB queries without sanitization, so submitting MongoDB operator objects (e.g. $ne, $regex, $gt) through the prediction API causes the query to match records belonging to other users in the shared chat collection. Only confidentiality is affected (CVSS 4.0 base 8.7, VC:H, no integrity or availability impact); no CISA KEV listing, EPSS score, or public exploit code was provided at time of analysis, and vendor patch status is 'available' with version 3.1.4 as the fix.

HIGH

8.7

–

44

CVE-2026-91936

Flowise releases prior to 3.1.4 ship GitHub Actions workflows that interpolate workflow_dispatch inputs such as tag_version and node_version directly into shell run blocks, allowing OS command injection during Docker image builds. The flaw is reachable only by a user who already holds write access to the repository (CVSS 4.0 PR:H), but the payoff is large: arbitrary command execution on the build runner with access to AWS credentials and Docker Hub tokens. No public exploit code or CISA KEV entry was reported at time of analysis, and the vendor has published a fix in 3.1.4 via GitHub Security Advisory GHSA-jrcq-qjw5-xx5q; note that this is a supply-chain/CI risk to the project's own build pipeline and to forks that reuse these workflows, not a runtime flaw in deployed Flowise instances.

HIGH

8.3

–

42

CVE-2026-91930

Authenticated users of Flowise before 3.1.4 can escalate to organization owner across tenant boundaries by supplying arbitrary organization IDs to the organizationuser and workspace membership endpoints, because those APIs are not scoped to the caller's own tenant. The result is full administrative control over victim organizations, including the ability to create workspaces and reach the victim tenant's resources. No public exploit code or CISA KEV listing was present in the source data, but the flaw is trivially automatable once an attacker holds any valid account, and vendor patch 3.1.4 is available.

HIGH

7.7

–

38

CVE-2026-91929

Cross-tenant authorization bypass in Flowise Enterprise endpoints (all versions before 3.1.4) allows an authenticated Enterprise user to operate on resources owned by other organizations — deleting arbitrary workspaces, inviting themselves into other tenants, modifying cross-organization roles, and reading or abusing stored SSO secrets. The root cause is CWE-862 (missing authorization): affected endpoints act on caller-supplied resource identifiers without verifying tenant ownership. Rated CVSS 7.6 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L), reachable over the network but requiring low-privileged Enterprise access; a vendor patch is available in 3.1.4, and no public exploit has been identified at time of analysis.

HIGH

7.6

–

38

CVE-2026-91933

Broken object-level authorization in Flowise's openai-realtime endpoints lets any authenticated user read tool definitions and execute tools belonging to ChatFlows in other workspaces by supplying an unscoped chatflowid, with both GET and POST requests affected. The flaw is fixed in Flowise 3.1.4 and affects all earlier releases; it is tracked as CWE-639 (authorization bypass through user-controlled key). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not supplied with this record, so risk should be judged from the authenticated-but-cross-tenant access model rather than from observed exploitation.

HIGH

7.6

–

38

CVE-2026-91938

Server-side request forgery in Flowise versions before 3.1.4 allows a low-privileged authenticated user to supply arbitrary URLs to the Cheerio, Playwright, and Puppeteer document loader nodes, bypassing the platform's built-in SSRF protections. Because the fetched response body is returned as document text, the flaw is a full-read SSRF rather than a blind one, exposing cloud instance metadata, internal-only services, and private network resources to the attacker. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation is currently unconfirmed; the vendor has released a patch in 3.1.4.

HIGH

7.6

–

38

CVE-2026-90535

Unauthenticated service disruption in Flowise before 3.1.4 allows any network attacker to forcibly abort active chatflow predictions belonging to other users. The /api/v1/text-to-speech/abort endpoint accepts caller-supplied chatflowId and chatId without verifying ownership, enabling targeted interruption of in-progress AI workflow sessions. No active exploitation (KEV) or public exploit code is confirmed at time of analysis; the attack is trivially low-complexity but requires a running target session and knowledge of valid identifiers.

MEDIUM

6.3

0.2%

32

CVE-2026-90534

Cross-workspace credential IDOR in Flowise versions up to and including 3.1.3 allows an authenticated low-privilege user in one workspace to invoke third-party provider API calls using credential secrets belonging to a different workspace. The POST /api/v1/node-load-method/:name endpoint is mounted without route-level permission checks and resolves credentials by raw database ID via getCredentialData() without verifying that the credential's workspaceId matches the caller's active workspace - a check that all other credential-read paths in Flowise correctly enforce. Statically confirmed affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables; the raw decrypted credential secret is not returned to the attacker, but provider-returned resource metadata is. Fixed in version 3.1.4; no public exploit identified at time of analysis.

MEDIUM

6.1

0.2%

31

CVE-2026-90580

Server-side request forgery in FlowiseAI Flowise up to version 3.0.2 allows authenticated users to redirect internal server-side HTTP requests by supplying attacker-controlled Host and X-Forwarded-Proto headers to the Evaluations endpoint, causing the server to construct the axios.post base URL from untrusted input rather than a trusted server-side value. The flaw enables the Flowise server to be leveraged as a proxy for reaching internal network resources, cloud metadata services, or adjacent microservices invisible to the external attacker. A publicly available proof-of-concept exists (GitHub issue #6687), and vendor-released patch 3.1.3 is available, though all affected versions (≤3.0.2) have been designated end-of-life by the maintainer.

LOW

2.1

0.2%

31

PoC

CVE-2026-90533

Broken access control in Flowise before 3.1.4 exposes organization owners' bcrypt password hashes and temporary tokens to any authenticated organization member via the GET /api/v1/organizationuser endpoint. The endpoint authenticates callers but performs no authorization check, allowing a low-privilege member to query any user ID and retrieve the owner's full user record - including stored credential hashes - enabling offline password cracking and subsequent full administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis; VulnCheck reported the issue with a fix confirmed in version 3.1.4.

MEDIUM

6.0

0.2%

30

Severity Breakdown

Monthly CVE Trend

Affected Products (7)

Top Risky CVEs