THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-90534 — Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMe

[NVD] CVE-2026-90534 — Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMe

mednvdPublished 2026-09-12

CVE-2026-90534 CVSS: None Published: 2026-09-12T13:16:51.247

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credenti

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-90534