CVE-2026-42861: FlowiseAI Mass Assignment Vulnerability in Variable Updates

# CVE-2026-42861: FlowiseAI Mass Assignment Vulnerability in Variable Updates

https://gcdradar.vercel.app/incidents/cve-2026-42861-flowiseai-mass-assignment-vulnerability-in-va · AIR-2026-0701 · closed 2026-05-14

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-05-14
- AI role: Attack on AI
- Products: FlowiseAI
- CVE ids: CVE-2026-42861
- CVSS: 7.6

## Summary

A mass assignment vulnerability in FlowiseAI allows users to reassign variables across arbitrary workspaces due to missing authorization checks. This flaw breaks tenant isolation in multi-workspace setups.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-06-08: CVE-2026-42861: Flowise is a drag & drop user interface to build a customized large language model flow. (https://nvd.nist.gov/vuln/detail/CVE-2026-42861)
- 2026-05-14: CVE-2026-42861: FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment (https://github.com/advisories/GHSA-6fw7-3q8r-m5vj)

## Sources

- 2026-05-14 GitHub Advisory Database: CVE-2026-42861: FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment https://github.com/advisories/GHSA-6fw7-3q8r-m5vj
- 2026-06-08 NVD: CVE-2026-42861: Flowise is a drag & drop user interface to build a customized large language model flow. https://nvd.nist.gov/vuln/detail/CVE-2026-42861

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.