CVE-2026-100605

Executive Summary

CVE-2026-100605 is a missing authorization vulnerability (CWE-862) in Flowise, an open-source low-code platform for building LLM applications and AI agents. Versions up to and including 3.1.4 fail to enforce route-level role-based access control (RBAC) on chat message endpoints, allowing any holder of a valid low-privileged API key to read and delete chat histories they should not have access to. With a CVSS base score of 7.1, the flaw exposes sensitive prompt data, model responses, and conversation records to unauthorized disclosure and destructive deletion.

Technical Analysis

The vulnerability resides in Flowise's authorization layer. The application issues API keys with differing privilege levels and is designed to enforce per-route permissions, including checks tied to specific flow (chatflow) permissions. According to the NVD description, Flowise through 3.1.4 "contains missing route-level RBAC checks on chat message endpoints." This means the route handlers backing chat message operations do not evaluate the caller's role or flow-level authorization before performing the requested action.

The consequence is a horizontal and vertical authorization bypass: a caller authenticating with a valid but low-privileged API key can invoke GET routes to read chat messages — exposing user prompts, model responses, and full chat histories — and DELETE routes to remove messages. Because the required flow permissions are not consulted, the API key's intended scope is irrelevant; authentication succeeds (the key is valid) while authorization is absent (no RBAC gate).

The root cause maps directly to CWE-862 (Missing Authorization). The flaw is not an authentication bypass — the attacker must possess a legitimate API key — but an access-control gap in which authenticated-but-underprivileged principals gain capabilities normally reserved for higher-privileged roles. The affected surface is network-reachable (AV:N), and the confidentiality and integrity impacts are both rated High by the CVSS vector, reflecting the ability to both read and delete data. The stated UI:R component indicates the attack vector involves some form of user interaction within the CVSS scoring model.

No public proof-of-concept, Nuclei template, or exploit code exists in the provided intelligence. The attack chain described below is inferred from the vulnerability class and the endpoint behavior named in the NVD description.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (missing route-level RBAC) and the affected endpoint categories (GET/DELETE chat message routes).

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Flowise 3.1.4 (or earlier) instance. Flowise deployments are commonly reachable via web interfaces and API layers, and version fingerprinting can confirm the affected range. The attacker must already hold a valid low-privileged API key — obtained through a legitimate low-privilege account, a leaked credential, a misconfigured integration, or broad key distribution — but does not need any elevated role.

2. Triggering the flaw. The attacker directs requests to the chat message GET and DELETE routes using their low-privileged API key. Because route-level RBAC checks are absent, the endpoints do not verify that the caller holds the required flow permissions before servicing the request. The authorization decision that should bind a caller to specific flows is simply not enforced at the route level.

3. Payload / execution method. At the vulnerability-class level, this is a direct request to an under-protected route rather than an injection or memory-corruption primitive. The "payload" is a normal, well-formed authenticated API call — a GET to retrieve chat messages and a DELETE to remove them — issued with a key that should not permit those operations. No malformed input is required; the missing control, not the request content, is the exploit.

4. Post-exploitation impact. Successful exploitation yields read access to chat histories, user prompts, and model responses (confidentiality compromise), and the ability to delete messages (integrity/availability compromise of conversation records). Exposed prompts and responses may themselves contain sensitive business data, credentials embedded in conversations, or proprietary AI workflow logic. Deletion of messages can corrupt audit trails, destroy evidence, or disrupt downstream workflows that depend on chat history.

Impact Assessment

The CVSS v3.1 base score is 7.1 (High), with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. Subscore breakdown:

• Attack Vector (Network): exploitable remotely; no local access required.
• Attack Complexity (High): the attack depends on pre-existing conditions — notably possession of a valid low-privileged API key and the presence of targeted chat data — which tempers the exploitability rating.
• Privileges Required (Low): only basic, low-privileged authenticated access is needed.
• User Interaction (Required): the scoring model assumes some user interaction component.
• Scope (Unchanged): impact is confined to the vulnerable component.
• Confidentiality (High): chat messages, prompts, and model responses are readable.
• Integrity (High): messages can be deleted.
• Availability (High): deletion of chat history affects data availability.

Business impact centers on data exposure and data destruction in AI/LLM applications. Organizations running Flowise to host customer conversations, internal knowledge workflows, or agent-driven automation may have conversations containing PII, trade secrets, or embedded secrets. The horizontal nature of the bypass means one low-privilege key can potentially reach data belonging to other users or flows. Because deletion is possible, the flaw also carries a sabotage and anti-forensics dimension. Blast radius scales with the number of deployed Flowise instances, the sensitivity of stored conversations, and how widely low-privileged API keys are distributed. CISA KEV status is NO, and no APT campaign or in-the-wild exploitation is documented in the provided intelligence.

Detection Guidance

Sigma Rule

title: Flowise Missing RBAC - Unauthorized Chat Message Access or Deletion
id: 9b1f2a44-7c3e-4f1a-9d20-flowise862
status: experimental
description: Detects access to Flowise chat message endpoints using low-privileged API keys, indicating missing route-level RBAC (CVE-2026-100605).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100605
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.100605
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'DELETE'
  selection_path:
    cs-uri-stem|contains:
      - '/chatmessage'
      - '/chatmessages'
      - '/api/v1/chatmessage'
  filter_ok:
    sc-status: 404
  condition: selection_method and selection_path and not filter_ok
falsepositives:
  - Legitimate administrative access to chat message routes
  - Authorized API integrations with proper flow permissions
level: medium

YARA Rule

rule CVE_2026_100605_Flowise_Missing_RBAC
{
    meta:
        description = "Detects Flowise chat message route handlers lacking route-level RBAC checks (CVE-2026-100605)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100605"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "chatmessage" ascii nocase
        $p2 = "chatmessages" ascii nocase
        $p3 = "/api/v1/" ascii nocase
        $f1 = "flowPermission" ascii nocase
        $f2 = "checkPermission" ascii nocase

    condition:
        (any of ($p*)) and (2 of ($f*) or uint16(0) == 0x5A4D)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100605 Flowise Missing RBAC - Chat Message Access/Deletion Attempt"; flow:established,to_server; http.method; content:"GET"; http.method; content:"DELETE"; http.uri; content:"chatmessage"; nocase; http.uri; content:"/api/"; nocase; reference:cve,2026-100605; classtype:attempted-user; sid:2026100605; rev:1;)

Elastic Detection

network where
  http.request.method in ("GET", "DELETE") and
  stringContains(http.request.uri, "chatmessage") and
  stringContains(http.request.uri, "/api/")

Splunk SPL Query

index=web OR index=proxy
(http.method=GET OR http.method=DELETE)
(http.uri="*chatmessage*" OR uri_path="*chatmessage*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, http.method, http.uri, status
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="flowise,web,cve-2026-100605,">
  <rule id="100605" level="10">
    <if_sid>31100</if_sid>
    <id>^2026100605$</id>
    <description>CVE-2026-100605: Flowise chat message endpoint access/deletion with insufficient RBAC (possible unauthorized chat history read/delete).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or patch source has been confirmed in any tracked source.

1. Immediate mitigations.

   • Restrict network exposure of Flowise instances: place chat message, chatflow, and API endpoints behind authenticated reverse proxies and IP allowlists. Do not expose the API layer directly to the internet.
   • Audit and minimize API key issuance. Rotate all low-privileged API keys and revoke any that are unused or broadly distributed, reducing the population of credentials that can exploit the missing RBAC.
   • Where a gateway or WAF is available, enforce authorization at the edge by denying GET/DELETE requests to chat message routes unless the caller presents an elevated, explicitly authorized role. Because the application itself does not enforce route-level RBAC, this compensating control must be applied externally.
   • Monitor and alert on GET/DELETE activity against chat message routes, especially from low-privilege keys (see Detection Guidance).

2. Patch / upgrade steps.

   • No fixed version exists as of this report. Track the Flowise project's releases and security advisories for a version that adds route-level RBAC enforcement to chat message endpoints.
   • When an update is published, upgrade promptly and verify that GET and DELETE chat message routes now enforce required flow permissions for all callers.
   • Until then, treat the deployment as vulnerable and apply the compensating controls above.

3. Long-term hardening.

   • Adopt centralized, deny-by-default authorization at the route layer so every endpoint evaluates caller role and resource-level (flow) permissions before serving requests.
   • Enforce least privilege on API keys, scoping each key to a specific set of flows and operations.
   • Implement immutable logging of chat message access and deletion events to preserve audit integrity and support incident response.
   • Perform regular authorization testing (BOLA/RBAC bypass testing) against multi-tenant and multi-flow features such as chat history.

References

• NVD — CVE-2026-100605: https://nvd.nist.gov/vuln/detail/CVE-2026-100605
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• Flowise project repository and release notes (consult the upstream project for any future security fix)
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-100605 in the provided intelligence; CISA KEV status is NO and no public PoC or exploit code is known.