CVE-2026-100608

Executive Summary

CVE-2026-100608 is a broken authorization vulnerability (CWE-862) in Flowise through version 3.1.4 affecting the BullMQ admin dashboard when the server operates in queue mode with the dashboard enabled outside of cloud mode. Any authenticated user, including the lowest-privileged member of any tenant, can access the full Bull-Board UI across the entire instance, exposing all queues and job payloads plus cross-tenant write actions. With a CVSS base score of 8.3 and no patch available, organizations running affected Flowise configurations face high confidentiality and integrity impact.

Technical Analysis

The vulnerability resides in the authorization model enforced on the BullMQ admin dashboard mount point. When Flowise is configured with MODE=queue, ENABLE_BULLMQ_DASHBOARD=true, and the instance is not in cloud mode (!isCloud()), the /admin/queues mount is protected solely by the verifyTokenForBullMQDashboard middleware. This middleware validates the JWT presented by the requester but performs no role, permission, or workspace/organization scoping check.

Two design conditions compound the flaw. First, the mount lies outside the /api/v1/* path prefix, so the platform's global API authorization gate does not apply to it. Second, the middleware performs authentication only — it verifies token validity but does not consult any authorization context. The result is a pure broken access control condition: authentication succeeds for any valid user token, but no authorization decision is made regarding whether that user should reach the dashboard or which queues and jobs they may view.

Because the Bull-Board UI surfaces queue contents instance-wide, the confidentiality boundary between tenants collapses. Job payloads visible through the dashboard include chat inputs, overrideConfig (which may carry credentials and prompts), chatflow.flowData graph definitions containing custom function source code, credential IDs and system prompts, chatIds, files, and the originating orgId/workspaceId. The dashboard's write actions — retry, remove, promote, and clean — are likewise usable across tenants. An attacker with any valid low-privilege account can therefore not only read sensitive cross-tenant job data but also manipulate queue state affecting other organizations.

The flaw class is straightforward: an administrative interface is exposed with authentication but without authorization, and it sits outside the standard API gate that would otherwise apply tenant scoping. No patched version was available as of the advisory.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/target identification. The attacker identifies a Flowise instance operating in queue mode with the BullMQ dashboard enabled and not in cloud mode. This can be inferred from reachable /admin/queues paths and responses consistent with a Bull-Board UI. No exploit code is required for identification.

2. Triggering the flaw class. The attacker obtains any authenticated account — including the lowest-privileged member of any tenant on the instance. Using a valid JWT, the attacker requests the /admin/queues mount. The verifyTokenForBullMQDashboard middleware validates the token but performs no role, permission, or workspace/organization scoping check, and because the mount lies outside /api/v1/*, the global API gate does not apply. Authentication succeeds and access is granted without an authorization decision.

3. Access at the vulnerability-class level. The attacker reaches the full Bull-Board UI and views all queues and job payloads across the entire instance. Exposed payload data includes chat inputs and overrideConfig values (potentially credentials and prompts), chatflow.flowData graph definitions with custom function source code, credential IDs and system prompts, chatIds, files, and originating orgId/workspaceId values. No payload construction or injection is needed; the flaw is purely an authorization bypass on a legitimate administrative UI.

4. Post-exploitation impact. With cross-tenant read access, the attacker harvests credentials, prompts, flow source code, and file references belonging to other tenants. The dashboard's write actions (retry, remove, promote, clean) are usable across tenants, enabling queue manipulation that can disrupt or alter processing for other organizations. Harvested credentials and configuration data can support lateral movement or further compromise of dependent systems.

Impact Assessment

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L yields a base score of 8.3. Attack is network-reachable (AV:N) with low complexity (AC:L) and requires only low privileges (PR:L) — an authenticated member of any tenant, not an administrator. No user interaction is required (UI:N). Confidentiality impact is High (C:H): all queues and job payloads across the entire instance are readable, including chat inputs, overrideConfig credentials and prompts, chatflow.flowData with custom function source, credential IDs, system prompts, chatIds, and files. Integrity impact is High (I:H): retry, remove, promote, and clean actions can be executed across tenants, altering queue state and job outcomes for other organizations. Availability impact is Low (A:L): the write actions are destructive to individual jobs/queue state rather than the whole service.

The blast radius is instance-wide rather than tenant-scoped. Any organization sharing a single Flowise deployment in the affected configuration has its job data and queue state exposed to every other authenticated user on that deployment.

Detection Guidance

Sigma Rule

title: Flowise BullMQ Dashboard Unauthorized Cross-Tenant Access
id: 3f9b2c41-7a8e-4d6f-9c1a-5e0d2b7f4a11
status: experimental
description: Detects access to the Flowise BullMQ admin dashboard mount outside /api/v1/* that may indicate exploitation of CVE-2026-100608 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100608
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|startswith: '/admin/queues'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'DELETE'
  condition: selection_path and selection_method
falsepositives:
  - Legitimate administrative access by authorized operators
level: medium
tags:
  - attack.t1190
  - cve.2026.100608

YARA Rule

rule CVE_2026_100608_Flowise_BullMQ_Dashboard_Authz
{
    meta:
        description = "Detects Flowise configuration/indicators related to CVE-2026-100608 BullMQ dashboard authorization bypass"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100608"
        date = "2026-01-01"
        severity = "high"

    strings:
        $mount   = "/admin/queues" ascii wide
        $mw      = "verifyTokenForBullMQDashboard" ascii wide
        $mode    = "ENABLE_BULLMQ_DASHBOARD" ascii wide
        $queuem  = "MODE=queue" ascii wide
        $board   = "Bull-Board" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or
        (any of ($mount, $board) and any of ($mw, $mode, $queuem))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100608 Flowise BullMQ Dashboard Authorization Bypass Attempt"; flow:established,to_server; http.uri; content:"/admin/queues"; startswith; nocase; http.request_body; content:"retry"; nocase; sid:2026100608; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-100608; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100608;)

Elastic Detection

network where network.protocol == "http" and
  startsWith(url.path, "/admin/queues") and
  http.request.method in ("GET", "POST", "PUT", "DELETE")

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/admin/queues*"
| eval auth_present=if(isnull(cookie) OR cookie="", "no", "yes")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, method, status
| where count > 0
| table first_seen, last_seen, src_ip, method, uri_path, status, count

Wazuh OSSEC Rule

<group name="flowise,web,">
  <rule id="100608" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/admin/queues</url>
    <description>CVE-2026-100608: Flowise BullMQ dashboard access (potential authorization bypass)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100608,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1. Immediate mitigations. Disable the BullMQ dashboard by setting ENABLE_BULLMQ_DASHBOARD=false on any instance that does not strictly require it. If the dashboard must remain enabled, do not run with the affected configuration combination (MODE=queue, ENABLE_BULLMQ_DASHBOARD=true, !isCloud()) unless the instance is isolated. Restrict network reachability to the /admin/queues mount using a reverse proxy, WAF, or firewall rules so that only trusted administrative networks can reach it. Because any authenticated user can reach the dashboard, treat all tenant accounts as potentially privileged against this mount and enforce an external authorization layer in front of it.

2. Patch/upgrade steps. No patched version is available as of the advisory. Track the Flowise project for a fixed release and upgrade promptly once published. Maintain an inventory of instances running queue mode with the dashboard enabled to prioritize remediation. Do not rely on the verifyTokenForBullMQDashboard middleware alone, since it validates the JWT but performs no role, permission, or workspace/organization scoping check.

3. Long-term hardening. Apply defense in depth around administrative interfaces: place admin mounts behind authenticated proxies with role checks, ensure authorization decisions are made in addition to authentication, and verify that management interfaces sit within or behind the standard API authorization gate. Adopt least privilege for tenant accounts, rotate any credentials that may have been exposed through job payloads (including overrideConfig credentials and credential IDs), and audit queue activity for unauthorized retry, remove, promote, or clean operations.

References

• NVD — CVE-2026-100608: https://nvd.nist.gov/vuln/detail/CVE-2026-100608
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• Flowise project repository and release notes (vendor advisory pending; no patched version available as of the advisory)
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-100608 not listed; KEV status: NO)

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. No public PoC, exploit code, or Nuclei template was available at the time of reporting.