Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side validation and authorization checks, an authenticated user can manipulate internal attributes of a chatflow and reassign it to another workspace. This allows cross-workspace resource reassignment and unauthorized modification of deployment and visibility settings. This issue has been patched in version 3.1.2.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.
FlowiseAI Flowise versions prior to 3.1.2 contain a mass assignment vulnerability in the variable update endpoint. Authenticated users can modify server-controlled properties such as workspaceId without proper authorization checks, allowing reassignment of variables to arbitrary workspaces. This can break tenant isolation in multi-workspace environments. The issue has been fixed in version 3.1.2.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenAI Assistants Vector Store have no authentication middleware and the route path /api/v1/openai-assistants-vector-store is not in WHITELIST_URLS. However, it is also not protected by the main auth middleware when accessed via API key — the route requires API key auth (not whitelisted), but no permission checks exist on any operation. This issue has been patched in version 3.1.2.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.
Flowise versions prior to 3.1.0 contain a critical vulnerability (CVE-2026-41274) in the GraphCypherQAChain node, where user input is directly passed into the Cypher query execution pipeline without proper sanitization. This allows attackers to inject arbitrary Cypher commands, potentially leading to unauthorized data exfiltration, modification, or deletion on the underlying Neo4j database. The vulnerability is fixed in version 3.1.0. There are no known exploits in the wild at this time.
FlowiseAI Flowise versions prior to 3.1.0 contain a critical remote code execution vulnerability (CVE-2026-41264) in the CSV_Agents class. This vulnerability is due to insufficient sandboxing of Python scripts generated by the LLM, which allows unauthenticated attackers to execute arbitrary Python code with the privileges of the Flowise server user. The issue is fixed in version 3.1.0.
CVE-2026-41265 is a critical command injection vulnerability in FlowiseAI's Flowise product versions prior to 3.1.0. The flaw exists in the run method of the Airtable_Agents class, where an LLM-generated Python script is evaluated without proper sandboxing. An unauthenticated attacker can use prompt injection to cause the LLM to generate and execute malicious Python code on the server. This vulnerability allows remote code execution with high impact on confidentiality, integrity, and availability. The issue is fixed in version 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId directly in the request body. When called without a chatflowId, the endpoint uses the provided credentialId to decrypt the stored credential (e.g., OpenAI or ElevenLabs API key) and generate speech. This vulnerability is fixed in 3.1.0.
CVE-2026-41278 is a high-severity vulnerability in FlowiseAI's Flowise product versions prior to 3.1.0. The GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization, exposing sensitive information such as credential IDs, plaintext API keys, and password-type fields. The issue is exacerbated in the released v3.0.13 Docker image, which lacks the sanitization function entirely, leading to raw sensitive data exposure. This vulnerability is fixed in version 3.1.0.
CVE-2026-41276 is an improper authentication vulnerability in FlowiseAI Flowise versions prior to 3.1.0. It allows remote attackers to reset any user's password without authentication by exploiting a flaw in the resetPassword method of the AccountService class. The system fails to verify that a valid password reset token was generated before allowing a password reset. An attacker who knows a user's email can submit a reset request with a null or empty token and arbitrarily set a new password. This vulnerability is fixed in version 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated users to control the primary key (id) and internal state fields of DocumentStore entities. Because the service uses repository.save() with a client-supplied primary key, the POST create endpoint behaves as an implicit UPSERT operation. This enables overwriting existing DocumentStore objects. In multi-workspace or multi-tenant deployments, this can lead to cross-workspace object takeover and broken object-level authorization (IDOR), allowing an attacker to reassign or modify DocumentStore objects belonging to other workspaces. This vulnerability is fixed in 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.com sends a reset password link over the unsecured HTTP protocol instead of HTTPS. This behavior introduces the risk of a man-in-the-middle (MITM) attack, where an attacker on the same network as the user (e.g., public Wi-Fi) can intercept the reset link and gain unauthorized access to the victim’s account. This vulnerability is fixed in 3.1.0.
Flowise versions prior to 3.1.0 have an authentication bypass vulnerability that allows unauthenticated attackers to obtain OAuth 2.0 access tokens linked to public chatflows. By accessing a public chatflow configuration endpoint, attackers can retrieve internal workflow data including OAuth credential identifiers, enabling them to refresh and acquire valid OAuth tokens without authentication. This vulnerability is fixed in version 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass the intended API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration. This vulnerability is fixed in 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services) This vulnerability is fixed in 3.1.0.
FlowiseAI Flowise versions prior to 3.1.0 contain a vulnerability that allows unrestricted upload of JavaScript files by modifying the Chatflow configuration file upload settings. This enables attackers to upload malicious Node.js web shells to the server, potentially leading to remote code execution. The vulnerability is identified as CWE-434 and has a CVSS score of 7.1, indicating high severity. A fix for this issue is available in version 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. This vulnerability is fixed in 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during account creation. This enables client-controlled manipulation of ownership metadata, timestamps, organization association, and role mappings, breaking trust boundaries in a multi-tenant environment. This vulnerability is fixed in 3.1.0.