CVE-2026-90534

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace, unlike other credential read paths which are workspace-scoped. As a result, an authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace and cause Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4.

• CWE-639

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hqvm-7539-v83j
• https://www.vulncheck.com/advisories/flowise-before-3.1.4-cross-workspace-credential-idor-via-node-load-method

Published

Sep 12, 2026

Last Modified

Sep 12, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90523A vulnerability was identified in jaychouchannel Tourism-Man…7.3
• CVE-2026-90524A security flaw has been discovered in jaychouchannel Touris…7.3
• CVE-2026-90525A weakness has been identified in itsourcecode Sales and Inv…6.3
• CVE-2026-90526A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-9053Mothra would respect a default value given by a website for …6.9
• CVE-2026-90533Flowise before 3.1.4 contains a broken access control vulner…6
• CVE-2026-90535Flowise versions before 3.1.4 contain an unauthenticated den…6.3
• CVE-2026-90536WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…5.3
• CVE-2026-90537WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…8.2
• CVE-2026-90538WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…5.3
• CVE-2026-90539WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…5.3
• CVE-2026-9054An attacker sending tcp, il, rudp, rudp, or gre packets with…9.2