Six Flowise flaws let users reach other workspaces' chats, keys and accounts

What happened

Six CVE records against Flowise, the open-source low-code builder for AI agents and chatflows, published on 26 September 2026, and every release through 3.1.4, the current one, is affected. The highest score, CVSS 3.1 8.3, goes to CVE-2026-100608: in queue mode the BullMQ admin dashboard shows any signed-in user every tenant's job payloads, prompts and credential IDs. Two break sign-in, both scored 7.7: anyone who can claim a victim's email address at any configured SSO provider can log in as that user (CVE-2026-100607) or take over a pending invitation (CVE-2026-100606).

The other three break workspace isolation: low-privilege API keys can read and delete chat history (CVE-2026-100605, 7.1), one workspace can make the server decrypt and use another's OpenAI or ElevenLabs key by its credential ID (CVE-2026-100609, 6.8), and upsert-history routes read and delete another workspace's vector-store history given a chatflow ID from a public share link (CVE-2026-100610, 7.5). Four of the six records state the flaw was unpatched at publication, and 3.1.4, released on 29 July, was still the latest Flowise release on npm on 2 October 2026, so no fixed release was confirmed as of that date.