High priorityDisclosed

Advisory · CVE-2026-100608

Flowise BullMQ dashboard lets any tenant user see and touch every queue

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. In queue mode with the dashboard enabled outside cloud mode, the /admin/queues mount validates the JWT but performs no role, permission, or workspace scoping, so any authenticated user, including the lowest-privileged member of any tenant, can view queues and job payloads across the instance (chat inputs, credentials in overrideConfig, chatflow definitions) and use write actions like retry, remove, and promote. No patched version is available.

Advisory published September 26, 2026Independent summary
Vendor
FlowiseAI
Product
Flowise
Identifier / CWE
CVE-2026-100608
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

The control room door checks that you work at the company, but never checks which team you are on. The intern from accounting can walk in, read everyone's live jobs, and push buttons that rerun or delete them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Dashboard enabled

    The deployment runs in queue mode with the BullMQ dashboard enabled outside cloud mode.

  2. 02JWT only

    The /admin/queues mount validates the JWT but performs no role, permission, or workspace scoping.

  3. 03Any user qualifies

    The lowest-privileged member of any tenant passes the check.

  4. 04Cross-instance access

    Job payloads across the instance are readable (chat inputs, credentials, chatflow definitions) and retry, remove, and promote actions are usable.

What happened

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard (CVE-2026-100608, CVSS 8.7). In queue mode with the dashboard enabled outside cloud mode, the /admin/queues mount validates the JWT but performs no role, permission, or workspace scoping. Any authenticated user, including the lowest-privileged member of any tenant, can view queues and job payloads across the entire instance, including chat inputs, credentials in overrideConfig, and chatflow definitions, and can use write actions such as retry, remove, and promote. No patched version is currently available.

What to do

  1. Disable the BullMQ dashboard (or the queue-mode admin mount) immediately if you do not need it.
  2. If the dashboard must stay on, restrict access at the network layer to trusted administrators only.
  3. Audit queue access logs for unusual viewing or write actions by low-privilege users.
  4. Rotate credentials that may have appeared in job payloads (overrideConfig, API keys).
  5. Apply the vendor patch as soon as it is released.

Management note

Authentication without authorization is the oldest dashboard bug in the book, and job queues are where the secrets live: chat inputs, credentials, and flow definitions all pass through BullMQ payloads. Turn the dashboard off or fence it at the network layer today.