CVE-2026-67622 FlowiseAI CVE debrief

Who should care

Flowise users with OpenAI Assistants integration configured should assess their exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify Flowise version and OpenAI Assistants integration configuration, assess exposure, and implement workspace-scoped authorization checks.

Why it matters

CVE-2026-67622 is a high-severity vulnerability in Flowise's OpenAI Assistants integration that allows authenticated attackers to access sensitive credentials and data across workspaces, requiring immediate attention from Flowise users.

• Authenticated attackers can access credentials belonging to other workspaces
• Attackers can enumerate cross-workspace assistant metadata
• Attackers can retrieve file and vector store listings
• Attackers can upload files into victim workspaces

Technical summary

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration. This vulnerability allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownership verification. The vulnerability is caused by a missing workspace-scoped authorization check in the credential lookup logic, which enables attackers to enumerate cross-workspace assistant metadata, retrieve file and vector store listings, and upload files into victim workspaces.

Defensive priority

Flowise users should prioritize verifying their exposure and assessing their OpenAI Assistants integration configuration.

Recommended defensive actions

• Verify Flowise version and OpenAI Assistants integration configuration
• Assess exposure and prioritize remediation
• Implement workspace-scoped authorization checks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information about the insecure direct object reference vulnerability in Flowise's OpenAI Assistants integration. Evidence is limited to public CVE and NVD records. Defenders should verify Flowise version and OpenAI Assistants integration configuration, assess exposure, and prioritize remediation based on the CVE and NVD information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.