Flowise: Critical IDOR and High SSRF Among Four Disclosed Vulnerabilities
Four vulnerabilities, including a critical IDOR and high-severity SSRF, were disclosed for Flowise through v3.1.4, impacting authentication and data access.
Key findings
- Four vulnerabilities in Flowise through 3.1.4 disclosed together, including one Critical and three High severity flaws.
- Critical CVE-2026-67622 allows unauthorized access to other workspaces' credentials via OpenAI Assistants integration.
- High CVE-2026-67620 (SSRF) and CVE-2026-70636 (Auth Bypass) exploit misconfigurations in security guards and authentication middleware.
- High CVE-2026-67621 permits unauthorized document store operations by authenticated users with view-level permissions.
- All vulnerabilities affect Flowise versions up to 3.1.4; users must update to a patched version.
On August 6th and 8th, 2026, a batch of four vulnerabilities affecting Flowise through version 3.1.4 was disclosed. These vulnerabilities, with severities ranging from High to Critical, were reported together, highlighting potential security weaknesses in the Flowise platform. The disclosures include a critical insecure direct object reference (IDOR) flaw, a server-side request forgery (SSRF) vulnerability, an authentication bypass, and a missing authorization issue.
The most severe of these is CVE-2026-67622, a critical (CVSSv3 9.9) insecure direct object reference vulnerability within the OpenAI Assistants integration. This flaw allows authenticated attackers to access credentials from other workspaces by manipulating Assistants endpoints with arbitrary credential UUIDs, bypassing workspace ownership checks.
Another significant vulnerability is CVE-2026-67620, a high-severity (CVSSv3 7.7) server-side request forgery (SSRF) flaw. This SSRF vulnerability exists in the SSRF guard implemented in httpSecurity.ts. The default deny list incorrectly omits Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and Alibaba Cloud metadata endpoint 100.100.100.200, potentially allowing authenticated attackers to interact with these cloud metadata services.
Furthermore, CVE-2026-70636, a high-severity (CVSSv3 7.5) authentication bypass vulnerability, was disclosed. This issue arises from prefix-based whitelist matching in the authentication middleware within packages/server/src/utils/constants.ts. Attackers can exploit this by sending a POST request to bypass authentication and access the OAuth2 credential refresh endpoint.
Lastly, CVE-2026-67621, a high-severity (CVSSv3 7.6) missing authorization vulnerability, allows authenticated workspace members with only view-level permissions to perform unauthorized document store operations. Attackers can achieve this by directly accessing unprotected mutation endpoints for document store operations, such as upsert and refresh.
All disclosed vulnerabilities affect Flowise versions up to and including 3.1.4. Users are strongly advised to update to a patched version as soon as possible to mitigate these risks. The coordinated disclosure of these vulnerabilities underscores the importance of regularly updating Flowise instances and reviewing security configurations, especially concerning integrations and authentication mechanisms.
The batch of vulnerabilities includes:
- CVE-2026-67622: Critical Insecure Direct Object Reference in OpenAI Assistants integration.
- CVE-2026-67620: High Server-Side Request Forgery due to an incomplete deny list.
- CVE-2026-70636: High Authentication Bypass exploiting prefix-based whitelist matching.
- CVE-2026-67621: High Missing Authorization in document store operations.
These issues collectively present a significant risk to Flowise deployments, particularly concerning unauthorized data access and system compromise. Prompt patching and security review are essential for all users.