CVE-2026-90534

Executive Summary

CVE-2026-90534 is an authorization (IDOR / confused deputy) flaw in Flowise, a low-code platform for building LLM applications, affecting versions up to and including 3.1.3. The POST /api/v1/node-load-method/:name endpoint is mounted without a route-level permission check and resolves credentials by raw Credential.id via getCredentialData() without validating Credential.workspaceId against the caller's active or shared workspace. Any authenticated low-privilege user or workspace API key can force Flowise to make third-party provider calls using another workspace's credential and return provider metadata to the attacker, though the raw secret itself is not exposed.

Technical Analysis

The vulnerable surface is the POST /api/v1/node-load-method/:name route. Two independent weaknesses combine here:

1. Missing route-level authorization. The endpoint is mounted without any permission check. Authentication (a valid user session or workspace API key) is required, but no additional authorization gate governs whether the caller may invoke the endpoint at all, nor which node component :name may be loaded.

2. Credential resolution lacking workspace scoping (CWE-639). When the route is invoked, it passes attacker-controlled values — nodeName, loadMethod, inputs, and a credential value — into the selected component's loadMethod. The referenced credential is resolved by raw Credential.id through getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace. The NVD description explicitly notes this differs from other credential read paths, which are workspace-scoped. This is the core defect: the identifier is trusted as an authorization token, so cross-tenant reads are possible.

Because the credential is decrypted server-side and used to drive an outbound provider call, Flowise functions as a confused deputy: it acts with the victim workspace's privileges while the requester controls the target. The description lists statically identified affected loadMethod routines, which bound the practical impact:

• Google Drive listFiles
• Google Sheets listSpreadsheets
• AWS DynamoDB KV Storage listTables

The raw credential secret is not returned to the attacker. What leaks is the provider metadata produced by those calls (e.g., file listings, spreadsheet listings, table names) — information the victim intended to be private to their workspace. This is a cross-tenant confidentiality breach scoped to what the enumerated provider operations can list, with secondary integrity implications from attacker-directed provider calls.

Notably, the CNA title and most metadata fields are empty; the technical substance derives entirely from the NVD description. No public PoC, exploit code, or Nuclei template is available, so post-exploitation specifics are inferred from the vulnerability class (authorized-but-unscoped data access) rather than demonstrated.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the NVD description and the IDOR/confused-deputy class.

1. Reconnaissance / target identification. The attacker obtains any valid low-privilege account or workspace API key in a Flowise instance (up to 3.1.3). Because the endpoint requires authentication but not authorization, a benign account is sufficient. The attacker enumerates or guesses credential identifiers belonging to other workspaces.

2. Triggering the flaw. The attacker sends POST /api/v1/node-load-method/:name selecting a component whose loadMethod performs a provider read. This is feasible precisely because there is no route-level permission check and because getCredentialData() resolves the supplied Credential.id without checking Credential.workspaceId against the caller's workspace.

3. Payload / execution at the vulnerability-class level. The attacker supplies a credential identifier (Credential.id) owned by the victim workspace along with nodeName, loadMethod, and inputs. Flowise decrypts the victim credential and invokes the provider call as the victim. Targeted loadMethod calls include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables.

4. Post-exploitation impact. The provider metadata returned by those calls (file/ spreadsheet/table listings) is disclosed to the attacker — cross-workspace data exposure. Per the description, the raw credential secret itself is not returned, so the attacker obtains provider-backed listings and metadata rather than the underlying secret. The attacker can repeat the call with different credential identifiers and provider methods to broaden enumeration.

Impact Assessment

• Confidentiality (High): Cross-tenant disclosure of third-party provider metadata (file, spreadsheet, and table listings) belonging to victim workspaces. Note the low-privilege authentication requirement bounds exposure to authenticated actors with valid sessions or API keys.
• Integrity (Low): The confused-deputy behavior causes provider calls to be made under the victim credential, allowing attacker-directed operations against the victim's cloud data surface within the enumerated loadMethod capabilities.
• Scope (Changed) [S:C]: The vulnerability lets one workspace affect resources controlled by another workspace and by external provider tenants — a genuine privilege boundary crossing, consistent with CWE-639 and the confused-deputy framing.
• Privileges Required (PR:L): Authentication as a low-privilege user or workspace API key is required; no administrator privilege is needed.
• Blast radius: Multi-tenant / multi-workspace Flowise deployments with Google Drive, Google Sheets, or AWS DynamoDB KV Storage credentials configured. Impact is constrained by which loadMethod routines exist and by provider authorization scopes on the victim credential.

Detection Guidance

Sigma Rule

title: Flowise Cross-Workspace Credential Access via Node-Load-Method (CVE-2026-90534)
id: 7b1c9f42-9053-4a11-9c2e-flowise3x1
status: experimental
description: Detects POST /api/v1/node-load-method/:name requests that may abuse missing workspace scoping on credential resolution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90534
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|startswith: '/api/v1/node-load-method/'
  selection_methods:
    cs-uri-stem|contains:
      - 'listFiles'
      - 'listSpreadsheets'
      - 'listTables'
  condition: selection_endpoint or (selection_endpoint and selection_methods)
falsepositives:
  - Legitimate single-workspace node testing within a user's own workspace
level: medium
tags:
  - attack.t1190
  - cve.2026-90534

YARA Rule

rule CVE_2026_90534_Flowise_NodeLoadMethod
{
    meta:
        description = "Detects Flowise node-load-method route / credential handling abuse (CVE-2026-90534)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90534"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $route    = "/api/v1/node-load-method/" ascii wide
        $nodeload = "loadMethod" ascii wide
        $credfunc = "getCredentialData" ascii wide
        $wspace   = "workspaceId" ascii wide
        $drive    = "listFiles" ascii wide
        $sheets   = "listSpreadsheets" ascii wide
        $dynamo   = "listTables" ascii wide
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or
        (any of ($route, $nodeload, $credfunc) and any of ($drive, $sheets, $dynamo))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90534 Flowise node-load-method cross-workspace credential access attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/node-load-method/"; http.uri; content:"listFiles" or content:"listSpreadsheets" or content:"listTables"; classtype:attempted-user; reference:cve,2026-90534; sid:202690534; rev:1;)

Elastic Detection

POST /api/v1/node-load-method/* requests from a workspace session
sequence by user.id
  [ http where http.request.method == "POST" and startsWith(http.request.url.path, "/api/v1/node-load-method/") ]

Splunk SPL Query

index=web
| search method=POST uri_path="/api/v1/node-load-method/*"
| eval suspect=if(match(uri_path,"(?i)(listFiles|listSpreadsheets|listTables)"),"node-load-method","other")
| stats count values(uri_path) as paths by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="flowise,web,">
  <rule id="202690534" level="10">
    <if_sid>31100</if_sid>
    <match>POST /api/v1/node-load-method/</match>
    <description>CVE-2026-90534: Flowise node-load-method invocation (possible cross-workspace credential abuse)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Upgrade to Flowise 3.1.4, where the NVD description states the issue is fixed. If upgrade is not immediately possible: restrict network access to the Flowise API so only trusted principals can reach POST /api/v1/node-load-method/:name; apply a reverse-proxy/WAF rule denying that path or requiring administrative role; rotate third-party provider credentials (Google Drive, Google Sheets, AWS DynamoDB) configured in affected workspaces; and audit provider logs for unexpected listFiles, listSpreadsheets, and listTables calls. Minimize stored provider credential scope to reduce confused-deputy reach.

2. Patch / upgrade steps. Deploy Flowise 3.1.4 (per NVD). Validate the fix removes the missing route-level permission check and enforces workspace scoping in getCredentialData(). Because no patch commit is confirmed by tracked sources, verify the fixed behavior directly before closing the ticket.

3. Long-term hardening. Enforce consistent workspace-scoped authorization on all credential read paths; never resolve credentials by raw Credential.id without checking Credential.workspaceId against the caller's active/shared workspace. Add route-level permission middleware to every API endpoint (defense in depth). Apply least-privilege scopes to stored provider credentials. Centralize audit logging of credential resolution and provider calls, and alert on cross-workspace credential references.

References

• NVD — CVE-2026-90534: https://nvd.nist.gov/vuln/detail/CVE-2026-90534
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Flowise project documentation / security advisories: https://docs.flowiseai.com/
• CISA KEV Catalog (verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC or exploit code is available as of this report. CISA KEV status: not listed. No threat-actor campaign or in-the-wild exploitation evidence was provided. EPSS is not yet scored by FIRST.org; no value is asserted here.