Flowise fixes multiple flaws enabling RCE, tenant abuse, and API credit theft

Flowise disclosed and fixed a cluster of high-severity vulnerabilities in versions prior to 3.1.0, including multiple paths to remote code execution. The most serious issues affect the platform's CSV and Airtable agent components, where unsanitized user input or LLM-generated Python code could be evaluated without proper sandboxing. Advisories for CVE-2026-41137, CVE-2026-41264, CVE-2026-41138, and CVE-2026-41265 describe authenticated and unauthenticated attack paths that let attackers inject malicious payloads through chatflows or agent inputs and execute code on the Flowise server, with potential impact to confidentiality, integrity, and availability.

Flowise 3.1.0 also addresses non-RCE flaws that could expose multi-tenant environments and consume third-party service credits. CVE-2026-41279 affects the unauthenticated text-to-speech endpoint at POST /api/v1/text-to-speech/generate, which could accept an arbitrary credentialId and use decrypted stored credentials such as OpenAI or ElevenLabs API keys to generate speech, enabling API credit abuse. In Flowise Cloud, CVE-2026-41267 allows improper mass assignment during account registration, letting unauthenticated attackers inject server-managed fields and manipulate organization associations, ownership metadata, timestamps, and role mappings across tenants. Organizations running Flowise or Flowise Cloud should upgrade to 3.1.0 and review exposed chatflows, stored credentials, and tenant registration controls.