CVE-2026-90534: Flowise IDOR leaks cross-workspace

CISO Take

Flowise, a widely used low-code builder for LLM agent apps, ships an endpoint that resolves and decrypts stored credentials without checking whether they belong to the caller's workspace, letting any authenticated low-privilege user or workspace API key impersonate another tenant's Google Drive, Google Sheets, or AWS DynamoDB connection. This is a classic confused-deputy/IDOR (CWE-639) in a multi-tenant SaaS context: there is no CVSS score, EPSS percentile, or CISA KEV listing yet, and no public exploit code or Nuclei template exists, so opportunistic mass-exploitation is unlikely today — but the bug is straightforward to weaponize by anyone who already holds a workspace account and can guess or enumerate credential IDs. The raw secret is never returned, but attacker-triggered calls to third-party APIs using a victim's identity can leak file listings, spreadsheet metadata, and database table names, which is a meaningful cross-tenant confidentiality breach for any organization running multi-tenant Flowise instances. Upgrade to Flowise 3.1.4 immediately; until then, audit node-load-method call logs for credential IDs accessed outside the caller's workspace and treat shared Flowise deployments as exposed.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

Medium. Exploitation requires only a low-privilege authenticated account or workspace API key — no zero-click or unauthenticated path — but the missing authorization check breaks a fundamental workspace-isolation guarantee, so any organization running Flowise as a shared or multi-tenant platform is exposed. No CVSS/EPSS score has been published, it is absent from CISA KEV, and no public exploit or scanner template exists, which lowers near-term mass-exploitation likelihood. However, the flaw is trivial to trigger once an attacker holds any workspace account, since it only requires supplying a foreign Credential.id to a documented API endpoint.

How does the attack unfold?

Initial Access

Attacker holds a low-privilege authenticated account or workspace API key in one Flowise workspace.

AML.T0012

Exploitation

Attacker calls POST /api/v1/node-load-method/:name with a victim workspace's Credential.id, bypassing the missing workspace-scope check.

AML.T0053

Impact

Flowise decrypts the victim's credential and performs the third-party provider call (Google Drive/Sheets/DynamoDB) as a confused deputy, returning provider metadata to the attacker.

AML.T0098

Initial Access

Attacker holds a low-privilege authenticated account or workspace API key in one Flowise workspace.

AML.T0012

Exploitation

Attacker calls POST /api/v1/node-load-method/:name with a victim workspace's Credential.id, bypassing the missing workspace-scope check.

AML.T0053

Impact

Flowise decrypts the victim's credential and performs the third-party provider call (Google Drive/Sheets/DynamoDB) as a confused deputy, returning provider metadata to the attacker.

AML.T0098

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade Flowise to version 3.1.4 or later immediately, where the endpoint enforces Credential.workspaceId checks consistent with other credential read paths. Until patched, restrict or disable multi-tenant workspace sharing, rotate credentials connected to Google Drive, Google Sheets, and DynamoDB integrations on any instance serving multiple untrusted workspaces, and review who holds workspace API keys. For detection, audit logs/traces of POST /api/v1/node-load-method/:name calls for credential IDs that don't belong to the requesting workspace, and monitor for anomalous Google Drive/Sheets/DynamoDB API activity from Flowise service accounts outside expected workspace-to-credential mappings.

How is it classified?

Auth Bypass Data Leakage Privacy Violation Agent Framework Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0098 - AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3 - AI system access control

NIST AI RMF

MANAGE-4.1 - Risk controls for third-party resources

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-90534?

Flowise, a widely used low-code builder for LLM agent apps, ships an endpoint that resolves and decrypts stored credentials without checking whether they belong to the caller's workspace, letting any authenticated low-privilege user or workspace API key impersonate another tenant's Google Drive, Google Sheets, or AWS DynamoDB connection. This is a classic confused-deputy/IDOR (CWE-639) in a multi-tenant SaaS context: there is no CVSS score, EPSS percentile, or CISA KEV listing yet, and no public exploit code or Nuclei template exists, so opportunistic mass-exploitation is unlikely today — but the bug is straightforward to weaponize by anyone who already holds a workspace account and can guess or enumerate credential IDs. The raw secret is never returned, but attacker-triggered calls to third-party APIs using a victim's identity can leak file listings, spreadsheet metadata, and database table names, which is a meaningful cross-tenant confidentiality breach for any organization running multi-tenant Flowise instances. Upgrade to Flowise 3.1.4 immediately; until then, audit node-load-method call logs for credential IDs accessed outside the caller's workspace and treat shared Flowise deployments as exposed.

Is CVE-2026-90534 actively exploited?

No confirmed active exploitation of CVE-2026-90534 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-90534?

Upgrade Flowise to version 3.1.4 or later immediately, where the endpoint enforces Credential.workspaceId checks consistent with other credential read paths. Until patched, restrict or disable multi-tenant workspace sharing, rotate credentials connected to Google Drive, Google Sheets, and DynamoDB integrations on any instance serving multiple untrusted workspaces, and review who holds workspace API keys. For detection, audit logs/traces of POST /api/v1/node-load-method/:name calls for credential IDs that don't belong to the requesting workspace, and monitor for anomalous Google Drive/Sheets/DynamoDB API activity from Flowise service accounts outside expected workspace-to-credential mappings.

What systems are affected by CVE-2026-90534?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI app builders, plugin/tool integrations, multi-tenant SaaS platforms.

What is the CVSS score for CVE-2026-90534?

CVE-2026-90534 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code AI app buildersplugin/tool integrationsmulti-tenant SaaS platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0098 AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace, unlike other credential read paths which are workspace-scoped. As a result, an authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace and cause Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4.

Exploitation Scenario

A contractor or low-privilege employee with access to one workspace on a shared Flowise instance discovers or enumerates Credential.id values used across workspaces. They send a POST request to /api/v1/node-load-method/googleDrive (or googleSheets/dynamoDb) specifying loadMethod=listFiles and a Credential.id belonging to a different, higher-value workspace. Flowise's backend resolves and decrypts that credential without verifying it belongs to the caller's workspace, then calls the Google Drive API on the attacker's behalf using the victim's OAuth token, returning a file listing (or spreadsheet/table names) to the attacker — exposing organizational data structure and enabling further targeted attacks, without ever needing the raw secret.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.