Flowise Cloud Vulnerability Exposes Multi-Tenant Environments
The National Vulnerability Database has identified a critical vulnerability (CVE-2026-41267) in Flowise Cloud, impacting versions prior to 3.1.0. This flaw allows unauthenticated attackers to inject server-managed fields during account registration. The exploit enables manipulation of ownership, timestamps, and role mappings, directly compromising trust boundaries in multi-tenant setups.
This improper mass assignment vulnerability, rated High (CVSS 8.1), is a serious concern for organizations leveraging Flowise for LLM workflow management. The ability for an attacker to inject arbitrary data into ownership and role structures can lead to account takeovers or privilege escalation within the Flowise Cloud environment.
What This Means For You
- If your organization uses Flowise Cloud, immediately verify that you are running version 3.1.0 or later. If not, patch or upgrade your instance without delay to mitigate the risk of unauthorized data manipulation and potential account compromise.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-41267 - Flowise Cloud Account Registration JSON Injection
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-41267 | Auth Bypass | Flowise Cloud account registration endpoint |
| CVE-2026-41267 | Misconfiguration | Flowise Cloud versions prior to 3.1.0 |
| CVE-2026-41267 | Information Disclosure | Improper mass assignment (JSON injection) in Flowise Cloud |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 23, 2026 at 23:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related Posts
CVE-2026-6732 — Libxml2 Denial of Service
CVE-2026-6732 — A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that...
OpenShell Mirror Mode Allows Arbitrary Code Execution
CVE-2026-41355 — OpenShell before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks. Attackers with mirror...
OpenClaw: High-Severity Access Control Bypass Looms
CVE-2026-41353 — OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile...