CVE-2026-91933: Flowise cross-workspace tool access

CISO Take

Flowise before 3.1.4 does not enforce workspace-level authorization on its openai-realtime endpoints, so any authenticated user who supplies another workspace's chatflow ID can list that workspace's tool definitions and execute its tools. This matters most in multi-tenant or multi-team Flowise deployments, because the tools often hold credentials and trigger real side effects such as API calls, database queries or messages sent on the victim's behalf. Exploitation likelihood is currently low: EPSS is 0.35% (73rd percentile), there is no public exploit or Nuclei template, the CVE is not in CISA KEV, and CISA SSVC says TRACK. However, the attacker needs a valid low-privilege account and the target's chatflow ID (high attack complexity), which limits the exposure to insider or compromised-account scenarios. Upgrade to Flowise 3.1.4 or later, and until then restrict access to the openai-realtime endpoints and review tool execution logs for calls that cross workspace boundaries.

Sources:NVDEPSSGitHub Advisoryvulncheck.comCISA SSVCATLAS

What is the risk?

High severity (CVSS 7.1) but moderated by real-world factors. The attack is network-reachable and needs no user interaction, but it needs a low-privilege authenticated account and knowledge of a victim chatflow ID (AC:H), which is a UUID that is hard to guess. Confidentiality and integrity impact are high because the attacker can read tool outputs and trigger side effects, while availability impact is low. There is no known exploitation, no public PoC and a low EPSS score, so the near-term likelihood is low. Risk is highest for multi-tenant SaaS offerings and shared enterprise Flowise instances whose chatflows are wired to sensitive tools and credentials.

How does the attack unfold?

Initial Access

Attacker authenticates with a valid low-privilege account in any Flowise workspace.

AML.T0012

Tool Discovery

Attacker sends a GET request to the openai-realtime endpoint with a victim's unscoped chatflowid to retrieve its tool definitions.

AML.T0084.001

Tool Execution

Attacker sends POST requests to execute the victim workspace's tools, with no workspace authorization check.

AML.T0053

Impact

Sensitive tool outputs are exposed and external side effects occur under the victim workspace's credentials.

AML.T0085.001

Initial Access

Attacker authenticates with a valid low-privilege account in any Flowise workspace.

AML.T0012

Tool Discovery

Attacker sends a GET request to the openai-realtime endpoint with a victim's unscoped chatflowid to retrieve its tool definitions.

AML.T0084.001

Tool Execution

Attacker sends POST requests to execute the victim workspace's tools, with no workspace authorization check.

AML.T0053

Impact

Sensitive tool outputs are exposed and external side effects occur under the victim workspace's credentials.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

IHigh

ALow

What should I do?

1 step

1) Upgrade Flowise to version 3.1.4 or later. 2) If patching is delayed, block or restrict access to the openai-realtime endpoints at the reverse proxy or WAF, or limit them to trusted users. 3) Audit user accounts in each workspace, remove unused ones and enforce strong authentication. 4) Rotate credentials and API keys wired to tools in sensitive workspaces if cross-workspace access is suspected. 5) Review access and application logs for requests to openai-realtime endpoints with chatflow IDs that do not belong to the caller's workspace, and for unexpected tool executions. 6) Apply least privilege to tools, so each tool carries only the permissions it needs and has human approval for high-impact actions. 7) Keep chatflow IDs out of shared links, logs and client-side code.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAgentAPIPluginAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0084.001- Tool Definitions AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage incidents

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-91933?

Flowise before 3.1.4 does not enforce workspace-level authorization on its openai-realtime endpoints, so any authenticated user who supplies another workspace's chatflow ID can list that workspace's tool definitions and execute its tools. This matters most in multi-tenant or multi-team Flowise deployments, because the tools often hold credentials and trigger real side effects such as API calls, database queries or messages sent on the victim's behalf. Exploitation likelihood is currently low: EPSS is 0.35% (73rd percentile), there is no public exploit or Nuclei template, the CVE is not in CISA KEV, and CISA SSVC says TRACK. However, the attacker needs a valid low-privilege account and the target's chatflow ID (high attack complexity), which limits the exposure to insider or compromised-account scenarios. Upgrade to Flowise 3.1.4 or later, and until then restrict access to the openai-realtime endpoints and review tool execution logs for calls that cross workspace boundaries.

Is CVE-2026-91933 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-91933, increasing the risk of exploitation.

How to fix CVE-2026-91933?

1) Upgrade Flowise to version 3.1.4 or later. 2) If patching is delayed, block or restrict access to the openai-realtime endpoints at the reverse proxy or WAF, or limit them to trusted users. 3) Audit user accounts in each workspace, remove unused ones and enforce strong authentication. 4) Rotate credentials and API keys wired to tools in sensitive workspaces if cross-workspace access is suspected. 5) Review access and application logs for requests to openai-realtime endpoints with chatflow IDs that do not belong to the caller's workspace, and for unexpected tool executions. 6) Apply least privilege to tools, so each tool carries only the permissions it needs and has human approval for high-impact actions. 7) Keep chatflow IDs out of shared links, logs and client-side code.

What systems are affected by CVE-2026-91933?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Multi-tenant LLM orchestration platforms, Tool-calling / function-calling pipelines, Realtime voice and chat LLM APIs.

What is the CVSS score for CVE-2026-91933?

CVE-2026-91933 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMulti-tenant LLM orchestration platformsTool-calling / function-calling pipelinesRealtime voice and chat LLM APIs

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0084.001Tool Definitions

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST requests to retrieve tool definitions and execute tools from victim workspaces, triggering external side effects and accessing sensitive tool outputs.

Exploitation Scenario

An attacker with a legitimate low-privilege account in one Flowise workspace obtains the chatflow ID of a victim workspace's agent, for example from a leaked embed snippet, shared link, log or insider knowledge. They send a GET request to the openai-realtime endpoint with that unscoped chatflowid and receive the tool definitions, learning that the agent can query a customer database and send Slack messages. They then send POST requests to execute those tools, pulling sensitive records through the tool outputs and triggering external actions under the victim workspace's credentials, without ever having been granted access to that workspace.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.