CVE-2026-100609

Executive Summary

CVE-2026-100609 is an authorization bypass (CWE-639) in the Flowise low-code LLM orchestration platform affecting the npm packages flowise and flowise-components through version 3.1.4. The flaw allows an authenticated user in one workspace to reference a credential UUID belonging to a different workspace, causing the server to decrypt and use the victim workspace's OpenAI or ElevenLabs API keys. Successful exploitation yields high confidentiality and integrity impact, as the attacker can drive AI operations billed to and authenticated as the victim tenant, and may poison shared assistant data structures via the import/export path.

Technical Analysis

The vulnerability is a classic Insecure Direct Object Reference (IDOR) / broken object-level authorization issue mapped to CWE-639 (Authorization Bypass Through User-Controlled Key). Per the NVD Description, the root cause is that credential lookups are performed by ID without scoping to the requesting user's workspace. The description explicitly cites the pattern findOneBy({ id: credentialId }) with no workspaceId condition. Because the query omits the workspace scope, any credential row in the database is resolvable by its UUID regardless of which workspace owns it.

The affected code paths enumerated in the NVD Description are:

• getAllOpenaiAssistants / getSingleOpenaiAssistant — reachable via GET /api/v1/openai-assistants and GET /api/v1/openai-assistants/:id.
• uploadFilesToAssistant — reachable via POST /api/v1/openai-assistants-file/upload/.
• deleteAssistant — reachable via DELETE /api/v1/assistants/:id, and noted as reachable after first importing a poisoned assistant row via POST /api/v1/export-import/import.
• A shared helper used by getVoices — reachable via GET /api/v1/text-to-speech/voices.

In each path, the server resolves the supplied credential ID, decrypts the stored secret (the description states the server "decrypt[s]" the key), and uses it to perform the upstream OpenAI or ElevenLabs operation on the attacker's behalf. The attacker never necessarily learns the plaintext key; the impact arises from the server acting as an authenticated proxy using the victim's key.

Two conditions are needed to mount the attack: (1) authenticated access to any workspace in the Flowise instance (CVSS PR:L), and (2) knowledge or discovery of a credential UUID belonging to another workspace. The credential UUID is the security-relevant user-controlled key. Because UUIDs are high-entropy, the attack has a meaningful precondition, which is reflected in the AC:H (High attack complexity) metric — the attacker must obtain a valid foreign credential UUID, whether through enumeration, leakage, shared exports, or reconnaissance of APIs that expose IDs. The absence of any requirement for user interaction is reflected in UI:N.

The dependency on decryption and upstream relay also means successful exploitation produces outbound network traffic from the Flowise host to OpenAI or ElevenLabs endpoints using another tenant's key — a useful detection pivot.

No public proof-of-concept, exploit code, or Nuclei template was available at the time of analysis. The attack chain described below is inferred from the vulnerability class (workspace-scoped object authorization bypass) and the endpoint list provided in the NVD Description.

Exploitation Scenarios

Step 1 — Reconnaissance / target identification. The attacker obtains an authenticated session on any workspace of a Flowise deployment (self-registration, low-privilege account, or a compromised user). The attacker then needs at least one credential UUID from a different workspace. Candidate sources include API responses that surface credential IDs, shared/exported flow or assistant definitions, or enumeration of predictable references if any are exposed. The NVD Description does not specify an ID-enumeration weakness, so this step should be treated as a prerequisite rather than an assumed primitive.

Step 2 — Triggering the authorization flaw. Because credential resolution uses findOneBy({ id: credentialId }) with no workspaceId filter, the attacker submits a request to an affected endpoint while passing the foreign workspace's credential UUID in place of their own. The NVD Description identifies the following reachable endpoints/operations as vulnerable:

• GET /api/v1/openai-assistants and GET /api/v1/openai-assistants/:id (via getAllOpenaiAssistants / getSingleOpenaiAssistant)
• POST /api/v1/openai-assistants-file/upload/ (via uploadFilesToAssistant)
• DELETE /api/v1/assistants/:id (via deleteAssistant), reachable after first importing a poisoned assistant row through POST /api/v1/export-import/import
• GET /api/v1/text-to-speech/voices (via the shared helper used by getVoices)

Step 3 — Execution at the vulnerability-class level. The attacker supplies the foreign credential UUID in the request. The server performs an unscoped lookup, decrypts the referenced API key, and uses it for the requested OpenAI or ElevenLabs operation. The attacker effectively operates under the victim workspace's credentials without holding the plaintext secret. No crafted payload beyond a valid authenticated request and a foreign credential UUID is required; this is an authorization-context substitution, not a memory-safety or injection exploit.

Step 4 — Post-exploitation impact. Consequences derive from acting as the victim workspace:

• Confidentiality (C:H): the response to GET /api/v1/openai-assistants and .../:id can disclose the victim workspace's assistant configuration and, via the upstream call, data derived from the victim's OpenAI account; the description also indicates the attacker can "decrypt and use that workspace's OpenAI or ElevenLabs API key" on their behalf.
• Integrity (I:H): deleteAssistant can remove assistant resources (DELETE /api/v1/assistants/:id), and uploadFilesToAssistant and the import path allow creating or modifying assistant-linked data — the description specifically notes importing a poisoned assistant row via POST /api/v1/export-import/import to reach the delete path.
• The victim incurs API usage and quota consumption billed to their OpenAI/ElevenLabs account, and any model access or data sent on their behalf is attributable to them.
• No availability impact is claimed (A:N).

No public PoC available; the above chain is inferred from the vulnerability class and the endpoint list in the NVD Description.

Impact Assessment

Business impact centers on cross-tenant credential abuse within Flowise deployments. An authenticated user of one workspace can cause the server to use another workspace's OpenAI or ElevenLabs API key, enabling unauthorized consumption of paid AI services, potential exposure of assistant configuration data, and unauthorized modification or deletion of assistant resources. The POST /api/v1/export-import/import route documented in the description also provides a path to inject a poisoned assistant row that the delete flow then acts upon, compounding integrity concerns.

Affected systems are self-hosted or cloud Flowise instances running the npm packages flowise and flowise-components through version 3.1.4, where multiple users or workspaces coexist. The scope metric S:U indicates the security authority is unchanged — the impact is confined to the affected component's authorization boundary rather than crossing a deeper trust boundary — but the practical blast radius spans all workspaces whose credential UUIDs the attacker can learn.

CVSS v3.1 is 6.8 (Medium), with AV:N (network-exploitable), AC:H (High complexity — requires a valid foreign credential UUID), PR:L (requires authentication), UI:N (no user interaction), and C:H/I:H/A:N. The high confidentiality and integrity subscores reflect that the attack grants effective use of another tenant's credentials and the ability to alter assistant data, while availability is unaffected. No EPSS score has been assigned by FIRST.org, and CISA KEV does not list this CVE, so there is no confirmed evidence of exploitation in the wild.

Detection Guidance

Sigma Rule

title: Flowise Cross-Workspace Credential IDOR Attempt
id: 8f2c1a44-7b91-4e6d-9c3a-1d5e7f9b2c10
status: experimental
description: Detects requests to Flowise endpoints associated with CVE-2026-100609 where cross-workspace credential reuse may occur.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100609
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method:
      - GET
      - POST
      - DELETE
    cs-uri-stem|contains:
      - '/api/v1/openai-assistants'
      - '/api/v1/openai-assistants-file/upload/'
      - '/api/v1/assistants/'
      - '/api/v1/text-to-speech/voices'
      - '/api/v1/export-import/import'
  selection_credential:
    cs-uri-query|contains:
      - 'credentialId'
  condition: selection_endpoint
level: medium
tags:
  - attack.t1078
  - cve.2026-100609

YARA Rule

rule CVE_2026_100609_Flowise_Unscoped_Credential_Lookup
{
    meta:
        description = "Detects Flowise source containing unscoped credential lookup pattern associated with CVE-2026-100609"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100609"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "findOneBy({ id: credentialId })" ascii wide
        $s2 = "flowise-components" ascii wide
        $e1 = "/api/v1/openai-assistants" ascii wide
        $e2 = "/api/v1/openai-assistants-file/upload/" ascii wide
        $e3 = "/api/v1/text-to-speech/voices" ascii wide
        $e4 = "/api/v1/export-import/import" ascii wide
        $n1 = "getAllOpenaiAssistants" ascii wide
        $n2 = "getSingleOpenaiAssistant" ascii wide
        $n3 = "uploadFilesToAssistant" ascii wide
        $n4 = "getVoices" ascii wide

    condition:
        uint32(0) == 0x04034b50 or
        any of ($s*) or
        (1 of ($e*) and 1 of ($n*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100609 Flowise Cross-Workspace Credential Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/openai-assistants"; nocase; http.uri; content:"credentialId"; nocase; classtype:attempted-user; reference:cve,2026-100609; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100609; sid:2026100609; rev:1;)

alert http any any -> any any (msg:"CVE-2026-100609 Flowise Assistant File Upload Credential Abuse"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/openai-assistants-file/upload/"; nocase; classtype:attempted-user; reference:cve,2026-100609; sid:2026100610; rev:1;)

alert http any any -> any any (msg:"CVE-2026-100609 Flowise TTS Voices Credential Abuse"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/text-to-speech/voices"; nocase; http.uri; content:"credentialId"; nocase; classtype:attempted-user; reference:cve,2026-100609; sid:2026100611; rev:1;)

alert http any any -> any any (msg:"CVE-2026-100609 Flowise Export-Import Poisoned Assistant Injection"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/export-import/import"; nocase; classtype:attempted-user; reference:cve,2026-100609; sid:2026100612; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ http.request.method == "POST" and url.path == "/api/v1/export-import/import" ]
  [ http.request.method == "DELETE" and wildcard(url.path, "/api/v1/assistants/*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_path = coalesce(uri_path, uri)
| where match(uri_path, "^/api/v1/(openai-assistants|openai-assistants-file/upload/|assistants/|text-to-speech/voices|export-import/import)")
| eval suspicious = case(
    match(uri_path, "/api/v1/openai-assistants"), "openai-assistants",
    match(uri_path, "/api/v1/openai-assistants-file/upload/"), "assistant-file-upload",
    match(uri_path, "/api/v1/assistants/"), "assistant-delete",
    match(uri_path, "/api/v1/text-to-speech/voices"), "tts-voices",
    match(uri_path, "/api/v1/export-import/import"), "export-import",
    true(), "other")
| stats count values(uri_path) as paths values(status) as status_codes by clientip, suspicious
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="flowise,cve-2026-100609,">
  <rule id="2026109" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">/api/v1/openai-assistants</field>
    <description>CVE-2026-100609: Possible Flowise cross-workspace credential access to OpenAI assistants endpoint</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="2026110" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/api/v1/assistants/</field>
    <field name="method">DELETE</field>
    <description>CVE-2026-100609: Possible Flowise unauthorized assistant deletion via cross-workspace credential</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="2026111" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">/api/v1/export-import/import</field>
    <description>CVE-2026-100609: Possible Flowise poisoned assistant import for cross-workspace exploitation</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No patched version was available at the time of publication, and no vendor fix, workaround, or tracked patch source is available.

1. Immediate mitigations:

• Restrict access to the affected API routes (/api/v1/openai-assistants, /api/v1/openai-assistants-file/upload/, /api/v1/assistants/:id, /api/v1/text-to-speech/voices, /api/v1/export-import/import) at the reverse-proxy or WAF layer to trusted identities only.
• Run Flowise in single-workspace/single-tenant mode where feasible to remove cross-workspace credential exposure.
• Reduce the population of users who can authenticate to the instance; disable open registration and enforce least privilege on workspace membership.
• Treat all credential UUIDs as sensitive; review any exports, logs, or API responses that surface credential IDs and restrict their distribution.
• Monitor outbound traffic from Flowise hosts to OpenAI and ElevenLabs for usage not attributable to the legitimate workspace owner.
• Rotate OpenAI and ElevenLabs API keys if cross-tenant credential use is suspected, and review upstream provider usage/billing for anomalies.

2. Patch/upgrade steps:

• No patch is currently available (patch confidence 0/4). Track the Flowise project channels for a fixed release that adds workspace scoping to credential lookups, and upgrade flowise and flowise-components immediately when released.
• Until then, do not rely on a version bump as remediation.

3. Long-term hardening:

• Enforce object-level authorization on all credential and resource lookups — every query resolving credentials by ID must include a workspaceId condition matching the authenticated principal.
• Add automated tests that assert cross-workspace resource access is denied for all endpoints that accept credential or resource IDs.
• Adopt tenant-scoping at the data-access layer (e.g., query guards/row-level scoping) rather than per-handler checks to prevent recurrence.
• Implement logging and alerting on credential-ID use that crosses workspace boundaries.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100609
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• Flowise npm package (flowise): https://www.npmjs.com/package/flowise
• Flowise Components npm package (flowise-components): https://www.npmjs.com/package/flowise-components
• CISA Known Exploited Vulnerabilities Catalog (this CVE is NOT listed; check for updates): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or confirmed exploit-in-the-wild activity was available at the time of analysis. No EPSS score had been assigned by FIRST.org.