CVE-2026-46475: Flowise: Assistant create+update mass-assignment allows cross-workspace assistant takeover

Synopsis

Mass-assignment vulnerability in Flowise, a drag-and-drop LLM workflow builder, allows an authenticated attacker to overwrite assistant objects belonging to other workspaces. The flaw is reachable over the network and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives the attacker full read, write, and disruption control over targeted assistants across workspace boundaries. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Flowise API over the network; the service must be exposed to an internet or internal network endpoint.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker only needs any valid Flowise user credential to send the malformed mass-assignment request.

• Victim interactionNot required

  No victim action is needed; the attacker submits the crafted request directly without relying on a user to click a link or take any other step.

• Attack complexityDetail

  The exploit has a prerequisite timing or environmental condition (AT:P) meaning specific attack requirements must align, though the base complexity is low once those conditions are met.

Blast Radius

• Reads all data stored in assistant objects belonging to other workspaces, including prompts, configuration, and any linked credentials.
• Overwrites or corrupts assistant configurations in victim workspaces, redirecting LLM behavior or destroying pipeline logic.
• Causes denial of service for victim workspace users by corrupting or deleting the assistants those workspaces depend on.
• Grants persistent cross-workspace control by reassigning assistant ownership, allowing the attacker to maintain access beyond the initial exploit.