CVE-2026-70472
Received Received - Intake

Flowise Credential Access via Unauthorized OpenAI Key Usage

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accept a client-controlled credential parameter and load credentials by id without checking whether that credential belongs to the caller workspace. Route permissions assistants:* only check feature access. The controller passes req.query.credential straight to the service, and the service uses findOneBy({ id: credentialId }), decrypts the credential, and calls OpenAI APIs without a workspaceId check. If an attacker knows another workspace credentialId, the attacker can use that workspace OpenAI key, read, modify, or delete victim vector stores and files, cause billing impact on the victim OpenAI account, and violate multi-tenant boundaries. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-70472
EUVD
EUVD-2026-52852

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
flowise flowise 3.1.3
flowiseai flowise to 3.1.3 (exc)
flowiseai flowise 3.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in Flowise versions up to 3.1.2. It allows an attacker with knowledge of another workspace's credential ID to access and use that workspace's OpenAI API key without proper authorization checks. The system loads credentials by ID without verifying ownership, enabling unauthorized access to OpenAI APIs, vector stores, and files.

Detection Guidance

To detect this vulnerability, check if your Flowise instance is running a version prior to 3.1.3. Inspect network logs for unauthorized API calls to OpenAI using credentials not belonging to the current workspace. Look for requests to the openai-assistants-vector-store endpoints with unexpected credential IDs.

Impact Analysis

An attacker could use your OpenAI API key to read, modify, or delete your vector stores and files. They could also cause billing impact on your OpenAI account and violate multi-tenant boundaries, leading to unauthorized access across workspaces.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It undermines multi-tenant security and data isolation.

Mitigation Strategies

Immediately upgrade Flowise to version 3.1.3 or later to patch the vulnerability. Review all OpenAI API keys in use and revoke any potentially exposed credentials. Audit workspace access logs for suspicious activity and restrict credential ID exposure in API requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70472. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart