CVE-2026-90534

Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

No known exploitation. EPSS puts it in the 30th percentile. Fixed in 3.1.4.

CVSS 3.16.5Medium EPSS percentile30th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix3.1.4Upgrade to this build

Published 2026-09-12Updated 2026-09-15Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

FlowiseAI FlowiseAffected: < 3.1.4Upgrade to: 3.1.4Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Flowise installation is version 3.1.3 or earlier and whether untrusted users or workspace API keys can access it.
Upgrade Flowise to version 3.1.4.
Review recent Google Drive, Google Sheets, and AWS activity for unexpected listing requests from Flowise.
If upgrading is delayed, limit Flowise access to trusted administrators and disable or restrict workspace API keys.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace, unlike other credential read paths which are workspace-scoped. As a result, an authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace and cause Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4.

In plain language

Written by AI from the record

Flowise versions through 3.1.3 let one signed-in workspace user make limited requests using another workspace’s connected service accounts, so small businesses using Flowise should update.

Authenticated cross-workspace credential IDOR in Flowise’s node-load-method endpoint allows attacker-controlled credential IDs to be decrypted and used without validating workspace ownership.

If you're affected

Cross-workspace data browsing
Cloud service metadata exposure
Unauthorized provider requests
Tenant separation failure

What is it

Flowise can connect to services such as Google Drive, Google Sheets, and AWS on behalf of different workspaces. The flaw is like a receptionist accepting another office’s keycard number without checking which office the caller belongs to: it can use that keycard for certain requests, although it does not hand over the keycard itself.

Who is affected

This matters to you if you run Flowise with more than one workspace and connect it to outside services. An attacker needs a Flowise login with limited access, or a workspace API key, to use the issue.

How urgent is it

No public attack code or confirmed real-world exploitation is currently known, and the issue is not listed in CISA’s known-exploited catalog. Treat this as a planned, prompt maintenance update—especially where separate customers, teams, or contractors share the same Flowise installation.

What to do — in detail

Confirm the deployed Flowise version and identify whether multiple workspaces use provider credentials through node load methods. Upgrade all 3.x deployments to 3.1.4; this is the fixed release identified by the vendor, and the findings do not identify a separate fixed version for another branch.

Before and after upgrading, test normal Google Drive, Google Sheets, and AWS DynamoDB integrations in each workspace. If an immediate upgrade is not possible, restrict Flowise to trusted users, remove unneeded workspace API keys, and prevent untrusted users from invoking node load methods that use shared provider integrations.

Review Flowise audit or application logs and the connected providers’ logs for unexpected file, spreadsheet, or table listing activity associated with Flowise. No CISA KEV remediation deadline applies because this CVE is not listed in KEV.

Technical context

CVE-2026-90534 is CVSS 6.5 (Medium): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. It is CWE-639, an authenticated insecure direct object reference affecting Flowise through 3.1.3. The POST /api/v1/node-load-method/:name path accepts an attacker-controlled credential ID and resolves/decrypts the credential without validating Credential.workspaceId against the caller’s workspace, enabling a confused-deputy request to third-party providers; the raw secret is not returned. No public exploit code is recorded, it is not in CISA KEV, and EPSS is 0.2% (12th percentile) with a flat trend. Exploit maturity is not publicly established.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS30th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 30th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 4 days, from the signal feeds we watch.

2026-09-16OpenVAS check added
2026-09-15Patch availablerecord updated
2026-09-14Record updated
2026-09-12Publishedweakness classified, att&ck mapped, record updated

Affected products

FlowiseAIoss-projectaka flowise-components, flowise, embed
- FlowiseWeb AppOn-premAI / ML / ai-agent-tooling

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact