Skip to content
Threat Feed
Subscribe

Tag

Tenant Isolation

4 briefs RSS
critical advisory

IBM API Connect: Remote code execution and tenant isolation bypass (CVE-2026-17150)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow remote authenticated attackers to execute arbitrary code and access other tenants due to insufficient validation of custom module uploads.

API Connect cve-2026-17150 rce tenant-isolation ibm
1t 1c
high advisory

Flowise Cross-Tenant Authorization Vulnerability

Flowise versions before 3.1.4 contain authorization gaps in Enterprise endpoints that allow authenticated users to perform cross-tenant operations including unauthorized workspace deletion and SSO credential access.

Flowise Enterprise +1 path-traversal arbitrary-file-write rce xss vulnerability nosql-injection web-application ssrf +3
4t 1c
high advisory

FlowiseAI Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment

FlowiseAI version 3.1.1 and earlier contains a mass assignment vulnerability in the assistant update endpoint, allowing authenticated users to modify server-controlled properties like workspaceId, createdDate, and updatedDate, enabling cross-workspace reassignment of assistants and breaking tenant isolation in multi-workspace environments.

FlowiseAI mass assignment tenant isolation web application
2r 1t
high advisory

FlowiseAI Mass Assignment Vulnerability in Variable Update Endpoint

FlowiseAI versions 3.1.1 and earlier contain a mass assignment vulnerability in the variable update endpoint allowing authenticated users to modify server-controlled properties like workspaceId, createdDate, and updatedDate, potentially breaking tenant isolation in multi-workspace environments (CVE-2026-42861).

flowise <= 3.1.1 mass assignment tenant isolation web application
2r