Detections
Analytics

SCA: security update for flowise (GHSA-chm3-vqcf-52rx)

high Tenable Self-Hosted Container Security Plugin ID 445619

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3,
 Flowise openai-assistants-vector-store endpoints accept a client-controlled credential parameter and load
 credentials by id without checking whether that credential belongs to the caller workspace. Route
 permissions assistants:* only check feature access. The controller passes req.query.credential straight to
 the service, and the service uses findOneBy({ id: credentialId }), decrypts the credential, and calls
 OpenAI APIs without a workspaceId check. If an attacker knows another workspace credentialId, the attacker
 can use that workspace OpenAI key, read, modify, or delete victim vector stores and files, cause billing
 impact on the victim OpenAI account, and violate multi-tenant boundaries. This issue is fixed in version
 3.1.3. (CVE-2026-70472)

Solution

Update the flowise library and its related packages to version 3.1.3 or later.

See Also

https://github.com/advisories/GHSA-chm3-vqcf-52rx

Plugin Details

Severity: High

ID: 445619

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 8/4/2026

Updated: 8/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.13

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-70472

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 4.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/4/2026

Vulnerability Publication Date: 8/4/2026

Reference Information

CVE: CVE-2026-70472