An authenticated vulnerability in Flowise Cloud allows unauthorized access to sensitive tenant secrets, posing a critical risk of cross-tenant data exposure.

This flaw involves improper access control (CWE-284) and exposure of sensitive information (CWE-200), where any authenticated user on the free tier can leverage the Custom JavaScript Function node to extract secrets from other tenants.

The exploitation of this vulnerability leads to a total compromise of sensitive environment variables, including OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets. With a CVSS score of 9.6, this represents a critical risk of unauthorized access to backend infrastructure and third-party services, potentially resulting in significant financial and data security breaches across the entire organization.

Immediate Action: Ensure that all Flowise Cloud instances are updated to the August 2025 version or later, as the vendor has implemented a fix for this cross-tenant isolation issue.

Proactive Monitoring: Review access logs for any suspicious or unauthorized usage of the Custom JavaScript Function node by standard users.

Compensating Controls: Restrict the use of the Custom JavaScript Function node to trusted administrative accounts until the environment is fully verified as patched.

Public Exploit Available: No

Given the critical CVSS severity score of 9.6 and the potential for total credential theft, organizations using the Flowise Cloud platform must prioritize this update immediately. Failure to remediate allows any authenticated user the potential to pivot into broader cloud infrastructure, making rapid deployment of the August 2025 patch the only effective path to securing your environment.