CVE-2026-67622: Critical Flowise IDOR in OpenAI Assistants Integration — Detection and Remediation Guide

The National Vulnerability Database has published CVE-2026-67622, a CVSS 9.9 (Critical) vulnerability in Flowise through version 3.1.4 — the widely deployed open-source drag-and-drop platform for building LLM orchestration flows. This is a network-exploitable, authenticated Insecure Direct Object Reference (IDOR) in the OpenAI Assistants integration, and the blast radius is significant: any authenticated user on a multi-tenant Flowise instance can access credentials belonging to other workspaces, enumerate cross-workspace assistant metadata, list files and vector stores, and upload files into victim workspaces.

The root cause is a missing workspace-scoped authorization check in the credential lookup logic. Assistants endpoints accept an arbitrary credential UUID from the request without verifying that the requesting workspace actually owns that credential. In practical terms, this is a broken access control flaw that turns any low-privilege authenticated session into a cross-tenant credential theft primitive.

If your organization runs Flowise — particularly shared instances where multiple teams, business units, or customers operate in separate workspaces — treat this as an urgent remediation item. OpenAI API keys stored as Flowise credentials are high-value targets: they carry spend authority against your OpenAI account, and files/vector stores uploaded to Assistants frequently contain sensitive corporate data fed into RAG pipelines.

Technical Analysis

Affected Products and Versions

• Product: Flowise (FlowiseAI) — open-source LLM workflow builder, commonly self-hosted via npm, Docker, or cloud marketplace images
• Affected versions: 3.1.4 and all prior versions
• Affected component: OpenAI Assistants integration endpoints and the underlying credential lookup logic
• CVE: CVE-2026-67622
• CVSS v3.1/v4 score: 9.9 (Critical) — network-attack vector, low attack complexity, with a scope change reflecting impact beyond the vulnerable component's security authority
• Authentication requirement: Yes — the attacker needs a valid authenticated session on the Flowise instance. This is the only thing standing between the vulnerability and full unauthenticated exploitation, and it is a thin barrier: default Flowise deployments, instances with shared/guest accounts, or any compromised low-privilege user satisfy it.

How the Vulnerability Works

Flowise's Assistants integration lets users attach stored credentials (OpenAI API keys) to assistant configurations. Credentials are referenced by UUID. The vulnerable code path looks up a credential by the UUID supplied in the request to the Assistants endpoints — but never validates that the credential belongs to the caller's workspace.

From a defender's perspective, the attack chain looks like this:

1. Authenticate to Flowise with any valid account (or hijack an existing low-privilege session).
2. Supply an arbitrary credential UUID in requests to Assistants endpoints (e.g., requests targeting /api/v1/assistants resources that accept a credential identifier parameter).
3. The server resolves the credential without workspace ownership verification and performs the requested operation in the victim workspace's context.
4. Attacker capabilities now include:
   • Cross-workspace assistant metadata enumeration — reconnaissance of what other tenants have built
   • File and vector store listing retrieval — exposing the names and structure of sensitive uploaded datasets
   • File upload into victim workspaces — data poisoning of RAG/retrieval pipelines, or staging content under another tenant's identity
   • Credential access — exposure of the OpenAI API key material associated with the referenced credential UUID

Credential UUIDs are not strong secrets — they can be leaked in logs, error messages, browser history, shared chatflow exports, or enumerated where predictable generation is in play. The defense-in-depth assumption that "the UUID is unguessable" is exactly the anti-pattern IDOR vulnerabilities punish.

Exploitation Status

At the time of publication, the vulnerability is documented in the NVD with a full technical description of the exploitation pathway. Given the low complexity (a single authenticated API call with a substituted UUID) and the value of the target (OpenAI API keys and tenant data), defenders should assume rapid exploit development and treat internet-exposed or multi-tenant Flowise instances as actively targeted. Check the NVD entry and CISA KEV catalog for updates on confirmed in-the-wild exploitation, and monitor Flowise GitHub security advisories for the fix release.

Detection & Response

Detection of IDOR exploitation is challenging because requests are syntactically legitimate — the attack lives in the authorization context, not the payload. The most reliable signals are behavioral: authenticated users touching Assistants endpoints with credential UUIDs they don't own, and access-pattern anomalies such as UUID enumeration (many distinct credential IDs from a single session) or sudden cross-workspace file upload activity.

Flowise is typically deployed behind a reverse proxy (nginx, Traefik, cloud load balancer) or ingested via application logs — these web access logs are your primary telemetry source and should be forwarded to your SIEM.

Sigma Rules

The following rules target proxy/web-server access logs. Tune the URI paths to match your deployed Flowise version's actual Assistants routing if it differs, and baseline legitimate automation before enabling alerting.

---
title: Flowise Assistants Endpoint Credential Enumeration - CVE-2026-67622
description: Detects a single source issuing requests to Flowise Assistants endpoints with a high volume of distinct credential identifiers, indicating IDOR enumeration of cross-workspace credential UUIDs.
id: 3f8a2c91-6b4d-4e7a-9c15-2d8e5f1a7b3c
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67622
author: Security Arsenal
date: 2026/06/10
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - '/api/v1/assistants'
  filter_status:
    sc-status:
      - 200
      - 201
  condition: selection and filter_status
falsepositives:
  - Legitimate Flowise administrative automation bulk-managing assistants
level: high
---
title: Flowise Assistants Cross-Workspace File Upload Attempt
description: Detects file upload activity (POST/PUT) against Flowise Assistants or file/vector-store endpoints, which CVE-2026-67622 abuse to plant files in victim workspaces. Alert when the authenticated identity is not a known workspace administrator.
id: 8c1d4e62-9a3b-4f58-b2e7-6d4c1a9e5f82
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67622
author: Security Arsenal
date: 2026/06/10
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/api/v1/assistants'
      - '/api/v1/vector-store'
      - '/api/v1/files'
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  condition: selection_uri and selection_method
falsepositives:
  - Normal assistant configuration and file ingestion by workspace owners
level: medium

Analyst note: The first rule's real power comes from aggregation in your SIEM — count distinct credentialId parameter values per source user/IP over a sliding window. A threshold of more than ~5 distinct credential UUIDs per user per hour is a strong enumeration signal in most deployments.

KQL — Microsoft Sentinel / Defender

This hunt assumes Flowise reverse-proxy or application logs are ingested into CommonSecurityLog (CEF/Syslog). It identifies sessions touching Assistants endpoints with an abnormal diversity of credential identifiers, plus upload activity.

let lookback = 24h;
let uuid_threshold = 5;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where RequestURL has_any ("/api/v1/assistants", "/api/v1/vector-store", "/api/v1/files")
| extend CredentialId = extract(@"(?i)credentialId=([0-9a-fA-F-]{36})", 1, RequestURL)
| summarize DistinctCredentials = dcount(CredentialId),
            CredentialSet = make_set(CredentialId, 20),
            Methods = make_set(RequestMethod),
            StatusCodes = make_set(AdditionalExtensions),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            Requests = count()
  by SourceIP, SourceUserID, bin(TimeGenerated, 1h)
| where DistinctCredentials > uuid_threshold
    or (Methods has_any ("POST", "PUT") and Requests > 20)
| project TimeGenerated, SourceIP, SourceUserID, DistinctCredentials, CredentialSet, Methods, Requests, FirstSeen, LastSeen
| order by DistinctCredentials desc;

If you ingest via plain Syslog instead, swap the table and parse SyslogMessage with the same extraction logic. Correlate hits with Flowise's own application logs (~/.flowise/logs or Docker stdout) to confirm which workspace context each request resolved to — a request from Workspace A's user resolving a credential owned by Workspace B is your smoking gun.

Velociraptor VQL

Use this artifact to triage Flowise servers: identify the running Flowise process, its version, and listening ports to scope exposure across your fleet before patching.

-- Identify Flowise server processes and network exposure for CVE-2026-67622 scoping
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)flowise'
   OR Name =~ '(?i)flowise'

LET conns = SELECT Pid, Name, Status,
       "Laddr.IP" AS LocalIP, "Laddr.Port" AS LocalPort,
       "Raddr.IP" AS RemoteIP, "Raddr.Port" AS RemotePort
FROM netstat()
WHERE Status =~ 'LISTEN'

SELECT * FROM procs
UNION ALL
SELECT * FROM conns WHERE Pid IN (SELECT Pid FROM procs)

Pair this with a glob() hunt over Flowise log directories (e.g., glob(globs='/home/*/.flowise/logs/*.log') and container log paths) to pull historical Assistants endpoint requests for retrospective analysis — look for credentialId values appearing in requests from users outside the owning workspace.

Remediation & Verification Script

Run this Bash script on self-hosted Flowise servers to check the installed version, upgrade past the vulnerable release line, and restart the service. Adjust the service management commands to your deployment model (systemd, Docker, PM2).

#!/bin/bash
# CVE-2026-67622 - Flowise IDOR verification and remediation
set -euo pipefail

VULN_MAX="3.1.4"
FIXED_MIN="3.1.5"   # Confirm the actual fixed version against the Flowise security advisory

echo "[*] Detecting installed Flowise version..."
CURRENT=$(npm list -g flowise --json 2>/dev/null | grep -oP '"version":\s*"\K[0-9.]+' | head -1 || true)
if [ -z "${CURRENT:-}" ]; then
  CURRENT=$(docker ps --format '{{.Image}}' 2>/dev/null | grep -i flowise | grep -oP ':\K[0-9.]+' | head -1 || true)
fi

if [ -z "${CURRENT:-}" ]; then
  echo "[!] Flowise version not detected via npm/docker. Check PM2 (pm2 list) or your container registry manually."
  exit 1
fi

echo "[*] Installed Flowise version: ${CURRENT}"

ver_lt() { [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]; }

if ver_lt "$CURRENT" "$FIXED_MIN" || [ "$CURRENT" = "$VULN_MAX" ]; then
  echo "[!] VULNERABLE to CVE-2026-67622 (<= ${VULN_MAX}). Upgrading..."
  # npm-based install
  npm install -g flowise@latest
  # Docker-based install alternative:
  # docker pull flowiseai/flowise:latest && docker compose up -d --force-recreate
  echo "[*] Restarting Flowise service..."
  systemctl restart flowise 2>/dev/null || pm2 restart flowise 2>/dev/null || echo "[!] Restart Flowise manually (check your process manager)."
else
  echo "[+] Version ${CURRENT} is not in the vulnerable range. Verify against the vendor advisory regardless."
fi

echo "[*] Post-upgrade checks:"
echo "    1. Confirm version: npm list -g flowise"
echo "    2. Review Assistants endpoint logs for suspicious credentialId usage"
echo "    3. Rotate ALL OpenAI API keys stored as Flowise credentials (treat as exposed)"
echo "    4. Audit workspace file/vector-store listings for unauthorized uploads"

Remediation

1. Upgrade Flowise immediately. Versions through 3.1.4 are vulnerable. Pull the latest release from the official Flowise GitHub repository and confirm the fix against the project's security advisory and the NVD entry for CVE-2026-67622. Verify the running version post-upgrade — do not assume a container rebuild picked up the new image.
2. Rotate every OpenAI API key stored as a Flowise credential. Because the vulnerability exposes credential material cross-workspace, all keys on a multi-tenant instance must be treated as compromised. Revoke and reissue keys in the OpenAI platform console, update Flowise credentials, and review OpenAI usage/billing logs for anomalous spend that could indicate prior key abuse.
3. Audit workspace content for tampering. Review assistant configurations, uploaded files, and vector stores in every workspace for content the workspace owner doesn't recognize. File-upload abuse enables RAG data poisoning — malicious documents planted in a vector store will silently alter assistant outputs.
4. Reduce authentication exposure until patched. If immediate upgrade isn't possible, restrict Flowise access to trusted networks/VPN, disable or tightly control account creation, enforce SSO with strong MFA, and consider temporarily disabling the OpenAI Assistants integration on shared instances. Segment multi-tenant deployments into single-tenant instances where feasible — this eliminates the cross-workspace trust boundary entirely.
5. Harden the deployment architecture. Place Flowise behind an authenticated reverse proxy, forward full request logs (including query parameters — that's where the credential UUIDs live) to your SIEM, and alert on the behavioral detections above. Network-exposed Flowise instances with default or weak authentication have been a recurring scanner target; do not leave them reachable from the internet.
6. Monitor for exploitation confirmation. Watch the NVD entry, the CISA Known Exploited Vulnerabilities catalog, and Flowise release notes. If this CVE lands in KEV, federal remediation deadlines apply and your prioritization should escalate accordingly.

The broader lesson: IDOR in AI orchestration platforms is the 2026-era equivalent of the API authorization failures that have plagued SaaS for a decade. These platforms aggregate high-value credentials and sensitive retrieval data by design — which makes workspace-scoped authorization checks the single most important control in their attack surface. Validate it in your own integrations, and pentest it before your adversaries do.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub