Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId directly in the request body. When called without a chatflowId, the endpoint uses the provided credentialId to decrypt the stored credential (e.g., OpenAI or ElevenLabs API key) and generate speech. This vulnerability is fixed in 3.1.0.
CVE-2026-41278 is a high-severity vulnerability in FlowiseAI's Flowise product versions prior to 3.1.0. The GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization, exposing sensitive information such as credential IDs, plaintext API keys, and password-type fields. The issue is exacerbated in the released v3.0.13 Docker image, which lacks the sanitization function entirely, leading to raw sensitive data exposure. This vulnerability is fixed in version 3.1.0.
CVE-2026-41276 is an improper authentication vulnerability in FlowiseAI Flowise versions prior to 3.1.0. It allows remote attackers to reset any user's password without authentication by exploiting a flaw in the resetPassword method of the AccountService class. The system fails to verify that a valid password reset token was generated before allowing a password reset. An attacker who knows a user's email can submit a reset request with a null or empty token and arbitrarily set a new password. This vulnerability is fixed in version 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated users to control the primary key (id) and internal state fields of DocumentStore entities. Because the service uses repository.save() with a client-supplied primary key, the POST create endpoint behaves as an implicit UPSERT operation. This enables overwriting existing DocumentStore objects. In multi-workspace or multi-tenant deployments, this can lead to cross-workspace object takeover and broken object-level authorization (IDOR), allowing an attacker to reassign or modify DocumentStore objects belonging to other workspaces. This vulnerability is fixed in 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.com sends a reset password link over the unsecured HTTP protocol instead of HTTPS. This behavior introduces the risk of a man-in-the-middle (MITM) attack, where an attacker on the same network as the user (e.g., public Wi-Fi) can intercept the reset link and gain unauthorized access to the victim’s account. This vulnerability is fixed in 3.1.0.
Flowise versions prior to 3.1.0 have an authentication bypass vulnerability that allows unauthenticated attackers to obtain OAuth 2.0 access tokens linked to public chatflows. By accessing a public chatflow configuration endpoint, attackers can retrieve internal workflow data including OAuth credential identifiers, enabling them to refresh and acquire valid OAuth tokens without authentication. This vulnerability is fixed in version 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass the intended API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration. This vulnerability is fixed in 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services) This vulnerability is fixed in 3.1.0.
FlowiseAI Flowise versions prior to 3.1.0 contain a vulnerability that allows unrestricted upload of JavaScript files by modifying the Chatflow configuration file upload settings. This enables attackers to upload malicious Node.js web shells to the server, potentially leading to remote code execution. The vulnerability is identified as CWE-434 and has a CVSS score of 7.1, indicating high severity. A fix for this issue is available in version 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. This vulnerability is fixed in 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during account creation. This enables client-controlled manipulation of ownership metadata, timestamps, organization association, and role mappings, breaking trust boundaries in a multi-tenant environment. This vulnerability is fixed in 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.
FlowiseAI Flowise versions prior to 3.1.0 contain a critical code injection vulnerability in the CSVAgent component. This vulnerability allows attackers to supply malicious Pandas CSV read code that is not properly sanitized, leading to command injection and remote code execution on the server. The issue is resolved in version 3.1.0.
FlowiseAI Flowise versions prior to 3.1.0 contain a high-severity remote code execution vulnerability (CVE-2026-41138) due to improper input sanitization in the AirtableAgent.ts component. User input is directly injected into a Python prompt template without verification, enabling code injection. This vulnerability is fixed in version 3.1.0. No known exploits are reported in the wild. Patch status is not explicitly confirmed in the advisory, so users should verify vendor guidance.
CVE-2026-40933 is a critical OS command injection vulnerability in FlowiseAI's Flowise product prior to version 3.1.0. It arises from unsafe serialization of stdio commands in the MCP adapter, allowing an authenticated attacker to add a malicious MCP stdio server with arbitrary commands. Despite input sanitization attempts, attackers can bypass these checks and execute arbitrary OS commands. This vulnerability is fixed in Flowise version 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. This vulnerability is fixed in 3.0.13.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in version 3.0.13.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.