CVE-2026-90534

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4

Description The POST '/api/v1/node-load-method/:name' endpoint lacks route-level permission checks and allows the invocation of component loadMethods using attacker-controlled nodeName, loadMethod, inputs, and credential values. The system resolves the selected credential via getCredentialData() using the raw Credential.id and decrypts it without verifying the Credential.workspaceId against the caller's active or shared workspace. This allows an authenticated low-privilege user or a workspace API key from one workspace to provide a credential ID belonging to another workspace. Consequently, the application acts as a confused deputy, executing third-party provider calls using the victim workspace's credentials and returning provider metadata to the attacker. Affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret is not exposed. A confused deputy is a security issue where a privileged entity is tricked by a less privileged entity into performing an action on its behalf.

Recommendations Update to version 3.1.4.