CVE-2026-67622

Executive Summary

CVE-2026-67622 is a critical (CVSS 9.9) Insecure Direct Object Reference (IDOR) vulnerability in Flowise, a popular open-source low-code platform for building LLM applications, affecting versions up to and including 3.1.4. The flaw resides in the OpenAI Assistants integration's credential lookup logic, where the system fails to verify that a supplied credential UUID belongs to the requesting user's workspace. An authenticated low-privileged attacker can exploit this to enumerate and access sensitive credentials, file/vector store listings, and upload malicious files into arbitrary victim workspaces, leading to potential full cross-tenant compromise and credential theft. Currently, no patch is available, making all Flowise deployments running 3.1.4 or earlier immediately at risk.

Technical Analysis

The vulnerability is rooted in Flowise's OpenAI Assistants integration—a feature designed to manage AI assistants backed by OpenAI's API. When an authenticated user interacts with assistant-related endpoints (e.g., retrieving assistant metadata, listing vector stores, uploading files), the application resolves the target workspace by looking up a credential object using a user-supplied Universal Unique Identifier (UUID) via an internal credential lookup API.

Root Cause: The insecure direct object reference stems from the absence of a workspace-scoped authorization check during the credential resolution phase. The endpoint accepts a raw credential UUID from the client request body or URL parameters, then directly queries the credential store without first validating that the referenced credential is owned by (or scoped to) the authenticated user's workspace context. An attacker with any valid Flowise account—even one with the lowest privilege level—can manipulate the credentialId payload parameter to reference UUIDs belonging to other workspaces in the same Flowise instance.

Attack Surface:

• Affected Endpoints: All Assistant endpoint handlers within the Anthropic/OpenAI Assistants integration, specifically those invoking getCredential() or equivalent internal functions.
• Data Exposed: Credential objects (OpenAI API keys, API secrets stored as encrypted blobs), assistant metadata (names, instructions, model configurations), vector store listings, and file upload targets.
• Authentication Required: Yes—valid low-privilege authenticated session.

Technical Mechanism:

1. The application loads the assistant configuration via the credential UUID from the request.
2. It queries the database for the credential record using findById(credentialId) without joining or filtering on workspaceId.
3. The retrieved credential is decrypted and returned in full to the client.
4. Upload/file-manipulation endpoints use the same credential to determine the target workspace for storage, allowing file injection into arbitrary buckets.

CWE-639 (Authorization Bypass Through User-Controlled Key): The vulnerability maps directly to this class, where predictable identifiers (UUIDs) are access keys, and the app trusts the identifier without verifying ownership.

Exploitation Scenarios

Attack Chain — Cross-Workspace Credential & Data Theft:

1. Reconnaissance: The attacker logs in to a Flowise instance (self-hosted or SaaS tenant) with any valid account. They query the application's authenticated API using a simple, valid request to an Assistant endpoint, e.g., GET /api/v1/openai-assistants/file with a known workspace's credential UUID. To enumerate valid UUIDs, the attacker uses a few techniques:

   • UUID prediction: If the app uses sequential or time-based UUID v1, the attacker can generate candidate IDs.
   • CORS/Error-based enumeration: Sending requests with random UUIDs and observing different HTTP status codes (e.g., 200 OK vs. 404 vs. 500) to confirm existence.
   • Referenced credentials in web UI: Because most LLM apps expose workspace member IDs in the UI, the attacker harvests other users' workspace IDs, then fuzzes the credential UUID parameter.

2. Weaponization (UUID Enumeration): Using a crafted GET request, the attacker switches the credentialId parameter to a UUID they suspect belongs to an admin's or another tenant's workspace:

   GET /api/v1/openai-assistants/{assistantId}?credentialId={victim-uuid}
   Authorization: Bearer <attacker_token>
   

   The endpoint processes the request without verifying that the credential UUID maps to the current user's workspace. A successful response includes full assistant metadata and the decrypted OpenAI API key.

3. Payload Execution / Data Exfiltration:

   • File Upload Attack: The attacker crafts a POST to /api/v1/vectorstore/{id}/upload with credentialId set to the victim's UUID, and payload containing a malicious file (e.g., a script or a file with sensitive data). The server stores the file into the victim's vector store, poisoning the victim's data for future LLM retrieval—a supply-chain/data-poisoning vector.
   • Credential Abuse: The stolen OpenAI API key allows the attacker to invoke the victim's AI model on the victim's billing account, incurring severe financial cost, or to read the victim's private assistant instruction sets (potentially containing secrets or business logic).

4. Post-Exploitation: With API keys and file access, the attacker pivots to the victim's connected external services (e.g., OpenAI dashboards, connected databases) to achieve full lateral movement inside the tenant. If the Flowise instance has SSO or admin consoles, the compromised credentials may grant broader system access.

Required Skills: Low. The attack requires only scripting skills to enumerate UUIDs and crafting standard HTTP requests. No memory corruption, no complex payloads.

Impact Assessment

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L — Critical (9.9).

  • Attack Vector (AV:N): Remotely exploitable over the network.
  • Attack Complexity (AC:L): No special conditions; UUIDs are guessable in many implementations.
  • Privileges Required (PR:L): Only a low-privilege authenticated account.
  • User Interaction (UI:N): None.
  • Scope (S:C): Chained—the compromise extends beyond the attacker's workspace to all workspaces on the same instance.
  • CIA Impact: High/high/low—complete confidentiality and integrity loss of credentials and data; some availability impact via file poisoning or resource exhaustion.

• Blast Radius: Any organization self-hosting Flowise (single-tenant or multi-tenant) with multiple workspaces, or commercial SaaS providers offering Flowise as a managed service. Because the vulnerability affects all API endpoints using the credential lookup, an attacker who successfully enumerates one UUID can systematically harvest all credentials on the instance.

Detection Guidance

Sigma Rule

title: Flowise OpenAPI Assistants - Cross-Workspace Credential Access
id: 9f2f16a0-8c04-4d92-a17b-2d11d3e44a71
status: experimental
description: Detects HTTP requests to Flowise OpenAI Assistants endpoints with credentialId parameters that differ from the authenticated user's workspace scope.
logsource:
  category: web
  product: generic
detection:
  selection:
    http.url|contains:
      - '/api/v1/openai-assistants'
      - '/api/v1/vectorstore/'
    http.method:
      - 'GET'
      - 'POST'
    http.url|contains: 'credentialId='
  filter_known_users:
    http.response.status_code: 200
  condition: selection and not filter_known_users
fields:
  - src_ip
  - user.name
  - http.url
  - http.response.status_code
falsepositives:
  - Legitimate multi-workspace administrator usage
level: high

YARA Rule

rule Flowise_Assistant_IDOR_Traffic
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects flowise assistant API paths with suspicious credentialId params"
        date = "2026-01-15"
    strings:
        $s1 = "/api/v1/openai-assistants"
        $s2 = "credentialId="
        $s3 = "/api/v1/vectorstore"
        $s4 = "file"
    condition:
        (uint16(0) == 0x0d0a or uint16(0) == 0x0a0d) and
        all of them
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"Flowise CVE-2026-67622 - Cross-Workspace Credential Enumeration Attempt";
    content:"/api/v1/openai-assistants";
    http_uri;
    content:"credentialId=";
    http_uri;
    nocase;
    urilen:>50;
    flow:established,to_server;
    classtype:attempted-recon;
    sid:2026762201;
    rev:1;
)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method == "GET" and http.request.uri contains "/api/v1/openai-assistants" and http.request.uri contains "credentialId="]
  [http where http.request.method == "POST" and http.request.uri contains "/api/v1/openai-assistants" and http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri, "%/api/v1/openai-assistants%") AND like(uri, "%credentialId=%")
| stats count by src_ip, user, uri, status
| where count > 10
| table _time, src_ip, user, uri, count

Wazuh OSSEC Rule

<group name="flowise, cve-2026-67622,">
  <rule id="675001" level="12">
    <match>/api/v1/openai-assistants</match>
    <match>credentialId=</match>
    <description>FLOWISE: Possible IDOR credential enumeration attempt against OpenAI Assistants endpoint</description>
    <group>authentication_success,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor patch, no commit reference, no CNA advisory exists as of this report.

Immediate Mitigations (Defense-in-Depth):

1. Disable the OpenAI Assistants integration if not in production use — via environment variable FLOWISE_DISABLE_OPENAI_ASSISTANTS=true or through the admin UI.
2. Network-level filtering: Place Flowise behind a reverse proxy or WAF that restricts API calls to known internal IP ranges and monitors for anomalous credentialId patterns.
3. Egress control: Restrict the Flowise service's outbound internet access to only the OpenAI API domains (api.openai.com). This limits the utility of stolen keys originating from the instance itself (though keys can be used externally).
4. Audit logs: Enable verbose API logging and alert on requests containing credentialId parameters where the user's workspace doesn't match the credential's owner. If using an SIEM, tune the SPL/Elastic rules above.

Patch/Upgrade Steps:

• Currently, no patched version exists. Monitor the Flowise GitHub repository (https://github.com/FlowiseAI/Flowise) for a release > 3.1.4 addressing authorization checks.
• When a fix is released, upgrade: npm update or npm install flowise@next to get the newest, then restart all service workers. Do not rely on flowise@latest unless it is confirmed to exceed 3.1.4.

Long-Term Hardening:

1. Implement out-of-band workspace verification: Any custom hardening or upstream patch must enforce credential.workspaceId == user.workspaceId at the DB layer, not just the UI layer.
2. Rotate all OpenAI/API keys that were present in the Flowise instance at any time during the exposure window—treat them as compromised.
3. Enforce strict workspace isolation: If multi-tenancy is required, run separate Flowise process containers or namespaces per tenant.
4. Add network micro-segmentation: Never expose Flowise's API to the public internet; place it behind an authenticated corporate VPN or SSO gateway.
5. Monitor OpenAI usage: Enable OpenAI API usage alerts per key to detect unexpected cost spikes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-67622
2. Flowise GitHub Repository: https://github.com/FlowiseAI/Flowise (watch for advisory/patch releases)
3. CWE-639 Reference: https://cwe.mitre.org/data/definitions/639.html
4. OpenAI Assistants API Docs: https://platform.openai.com/docs/assistants/overview (for understanding the credential data shared)
5. CISA Known Exploited Vulnerabilities Catalog: No entry exists at this time (CISA KEV: NO).

Threat Actor Activity: No known public exploit-in-the-wild or specific campaign has been documented at the time of writing. Given the low exploitation complexity and critical CVSS score, adoption by commodity botnets or initial-access brokers is highly likely within a short window following this disclosure. Enterprises should treat this as a zero-day condition and prioritize remediation accordingly.