CVE-2026-100608
Deferred Deferred - Pending Action

Flowise BullMQ Dashboard Authorization Bypass

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode (MODE=queue, ENABLE_BULLMQ_DASHBOARD=true, and !isCloud()), the /admin/queues mount is protected only by the verifyTokenForBullMQDashboard middleware, which validates the JWT but performs no role, permission, or workspace/organization scoping check; the mount also lies outside /api/v1/* so the global API gate does not apply. As a result, any authenticated user — including the lowest-privileged member of any tenant — can reach the full Bull-Board UI and view all queues and job payloads across the entire instance, including chat inputs and overrideConfig (which may carry credentials and prompts), chatflow.flowData graph definitions with custom function source code, credential IDs and system prompts, chatIds, files, and the originating orgId/workspaceId. The dashboard's write actions (retry, remove, promote, clean) are likewise usable across tenants. No patched version is available as of the advisory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100608
EUVD
EUVD-2026-87703

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowise flowise to 3.1.4 (exc)
flowiseai flowise to 3.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100608 is an authorization bypass vulnerability in Flowise versions 3.1.4 and below. When the server runs in queue mode with the BullMQ dashboard enabled and not in cloud mode, the /admin/queues endpoint lacks proper authorization checks. The middleware only validates the JWT token without verifying roles, permissions, or tenant scope, allowing any authenticated user to access and manipulate job payloads across all tenants.

Detection Guidance

Check if Flowise is running in queue mode with the BullMQ dashboard enabled by inspecting environment variables (MODE=queue, ENABLE_BULLMQ_DASHBOARD=true). Verify if the /admin/queues endpoint is accessible without proper role-based access controls. Use network scanning tools to detect unauthorized access to the BullMQ dashboard UI.

Impact Analysis

This vulnerability allows any authenticated user, including low-privileged members, to view sensitive data such as chat messages, system prompts, credential IDs, and proprietary code across all workspaces and organizations. It also enables unauthorized write actions like retrying, removing, promoting, or cleaning jobs across tenants.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data such as chat inputs, credentials, and system prompts. It exposes personal data and proprietary information across tenants, which could lead to data breaches and non-compliance with data protection regulations.

Mitigation Strategies

Disable the BullMQ dashboard by setting ENABLE_BULLMQ_DASHBOARD=false. Restrict access to the /admin/queues endpoint via network-layer controls (e.g., firewall rules). Monitor for unauthorized access attempts to the dashboard. Consider upgrading to a patched version if available in the future.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart