Flowise ≤3.1.4 — IDOR in the OpenAI Assistants integration gives cross-workspace credential access (CVSS 4.0 8.5, CWE-639); no fix, vendor sunsetting

Flowise ships three new CVEs into a sunset — an unauthenticated auth bypass that defeats an earlier fix, and cross-workspace credential access, with no vendor left to patch them

Flowise, the open-source visual builder for LLM and AI-agent workflows, picked up three CVEs on 2026-08-06 — and all three CVE records list the vendor's own sunset announcement (FlowiseAI) among their advisory references, which is the detail that turns a routine batch into an architecture decision.

The one that matters most needs no account. Per the assigning CNA, "Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts" — a POST to the OAuth2 credential-refresh route with a trailing credential identifier appended slips past a check that only compares path prefixes, triggering unauthorised OAuth token rotation against credentials belonging to any workspace and potentially breaking dependent integrations (VulnCheck, 2026-08-07). CVE-2026-70636 is scored CVSS 4.0 8.7 with integrity-only impact (VC:N/VI:H/VA:N) and, notably, "This is a bypass of CVE-2026-41273" — the same route has been fixed once already and the fix was incomplete (VulnCheck, 2026-08-07).

The other two need an account but cross a tenancy boundary. CVE-2026-67622 (CWE-639, CVSS 4.0 8.5) is an insecure direct object reference in the OpenAI Assistants integration: an authenticated attacker supplies an arbitrary credential UUID to Assistants endpoints, the credential lookup performs no workspace-ownership check, and the attacker can enumerate cross-workspace assistant metadata, retrieve file and vector-store listings, and upload files into a victim workspace (VulnCheck, 2026-08-07). CVE-2026-67621 (CWE-862, CVSS 4.0 7.2) lets a member holding only view-level permissions call the document-store upsert and refresh routes directly to trigger ingestion, refresh vector-database contents, consume embedding API credits and modify knowledge bases that downstream chatflows depend on (VulnCheck, 2026-08-07). Germany's BSI CERT-Bund carried all three on 2026-08-06 with the summary that an attacker can exploit multiple Flowise vulnerabilities to bypass security measures, disclose information and manipulate data, marking the advisory unpatched with no fixed release listed (BSI CERT-Bund, 2026-08-06).

No party reports exploitation of any of the three. What makes this more than a routine batch is that the usual next step does not exist: with the company winding down commercial operations, an operator waiting for a fixed release is waiting for something nobody has committed to ship, and the code remaining available for community forks is not the same thing as a maintained security response. Self-hosted AI-agent orchestration platforms have been a recurring source of pre-authentication paths — this pipeline has covered three separate confirmed-exploited Langflow flaws since mid-July — and Flowise now belongs to the subset of that class where the only remaining controls are ones the operator builds.

Detection concept: for CVE-2026-70636 the network-visible shape is an unauthenticated POST to an OAuth2 credential-refresh path carrying an extra trailing path segment beyond the route the allow-list was written for, with the resulting token rotation appearing in the OAuth provider's audit log as a refresh nobody initiated. For the two authenticated flaws, the tell is a session enumerating credential UUIDs or Assistants endpoints outside its own workspace, and a view-only account issuing document-store upsert or refresh calls at all. Hardening, in the absence of a patch: terminate the credential-refresh route at a reverse proxy that enforces authentication independently of the application, scope each workspace's provider credentials so a cross-workspace read yields keys that are separately revocable, and treat any internet-exposed Flowise instance as a candidate for removal from the perimeter rather than for patching.