CVE-2026-100608: Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode (MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud()), the /admin/queues mount is protected only by the verifyTokenForBullMQDashboard middleware, which validates the JWT but performs no role, permission, or workspace/organization scoping check; the mount also lies outside /api/v1/ so the global API gate does not apply. As a result, any authenticated user — including the lowest-privileged member of any tenant — can reach the full Bull-Board UI and view all queues and job payloads across the entire instance, including chat inputs and overrideConfig (which may carry credentials and prompts), chatflow.flowData graph definitions with custom function source code, credential IDs and system prompts, chatIds, files, and the originating orgId/workspaceId. The dashboard's write actions (retry, remove, promote, clean) are likewise usable across tenants. No patched version is available as of the advisory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are self-hosted Flowise instances running in queue mode with the BullMQ dashboard enabled: MODE=queue and ENABLE_BULLMQ_DASHBOARD=true. The issue applies when the instance is not running in cloud mode.
What access does an attacker need?
An attacker needs a valid JWT for any authenticated Flowise user. Even a lowest-privileged member of any tenant can access the dashboard; no additional role, permission, workspace, or organization authorization is checked.
What can an authenticated low-privilege user do through the dashboard?
They can view queues and job payloads across the entire instance, including data from other tenants. They can also perform queue write actions across tenants, including retrying, removing, promoting, and cleaning jobs.
What sensitive data may be exposed?
Job payloads may expose chat inputs, overrideConfig values that may contain credentials and prompts, chatflow.flowData definitions including custom function source code, credential IDs, system prompts, chat IDs, files, and originating organization and workspace IDs.
What mitigation is available if patching is not possible?
No patched version is available as of the advisory. Disable the BullMQ dashboard or avoid running the affected queue-mode configuration with ENABLE_BULLMQ_DASHBOARD=true.