Loading story…
Flowise fixed two closely related flaws in its OAuth2 credential refresh functionality that allowed unauthenticated access to POST /api/v1/oauth2-credential/refresh/:credentialId. In versions before 3.1.3, tracked as CVE-2026-70478, the endpoint was placed in WHITELIST_URLS without authentication, letting an attacker who knew a credential ID decrypt stored OAuth details, trigger a refresh with the provider, and receive the new access token in the response. The issue exposed connected third-party services to token theft and could also be abused to consume refresh-token quotas.
A follow-on bug, CVE-2026-70636, showed the earlier fix was incomplete and that Flowise through 3.1.4 still allowed authentication bypass through prefix-based whitelist matching. Researchers reported that crafted requests with a trailing credential identifier could still reach the refresh handler, which refreshed and updated OAuth credentials without validating caller identity, workspace ownership, or RBAC permissions. The flaw enabled cross-workspace token rotation and unauthorized mutation of credential state, and was described as a bypass of an earlier remediation tied to GHSA-6f7g-v4pp-r667.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record says disclosure@vulncheck.com received CVE-2026-70636, an authentication bypass affecting Flowise through version 3.1.4. The flaw allows crafted requests to the OAuth2 credential refresh endpoint to bypass authorization and trigger unauthorized token rotation.
The CVE record states that CVE-2026-70478, an unauthenticated OAuth2 token refresh flaw in Flowise, was received by security-advisories@github.com. The issue affects versions prior to 3.1.3 and can expose refreshed access tokens for connected services.
A CayCon advisory reported that Flowise 3.1.3 still allowed unauthenticated access to the OAuth2 credential refresh endpoint because prefix-based whitelist matching bypassed API key and JWT checks. The report says CayCon and piropatriot independently discovered and responsibly disclosed the issue, describing it as an incomplete remediation of an earlier fix.
Flowise addressed CVE-2026-70478 in version 3.1.3. The flaw involved the unauthenticated POST /api/v1/oauth2-credential/refresh/:credentialId endpoint being whitelisted and returning refreshed access tokens.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical insecure direct object reference flaw, tracked as **`CVE-2026-67622`**, affects **Flowise through version 3.1.4** and allows authenticated users to access resources tied to other workspaces in multi-tenant deployments. The bug resides in the **OpenAI Assistants integration**, where assistants-related endpoints accept an arbitrary credential UUID and resolve it without verifying that the credential belongs to the caller’s active workspace. The vulnerability is classified as **`CWE-639`** and has been rated **CVSS 9.9** under v3.1, with reporting also citing a **CVSS 4.0 score of 8.5**. By supplying another workspace’s credential UUID, an attacker can cause Flowise to use a victim workspace’s OpenAI Assistants credential, enabling cross-workspace access to assistant metadata, file listings, and vector stores, and allowing file uploads into victim workspaces. The flaw also creates a path to unauthorized OpenAI API consumption and potential billing impact on affected accounts. Public reporting said no active exploitation had been observed at publication, and a vendor fix was expected in a future Flowise release.
Aug 10, 2026
Flowise disclosed and fixed a cluster of high-severity vulnerabilities in versions prior to **3.1.0**, including multiple paths to remote code execution. The most serious issues affect the platform's CSV and Airtable agent components, where unsanitized user input or LLM-generated Python code could be evaluated without proper sandboxing. Advisories for **`CVE-2026-41137`**, **`CVE-2026-41264`**, **`CVE-2026-41138`**, and **`CVE-2026-41265`** describe authenticated and unauthenticated attack paths that let attackers inject malicious payloads through chatflows or agent inputs and execute code on the Flowise server, with potential impact to confidentiality, integrity, and availability. Flowise **3.1.0** also addresses non-RCE flaws that could expose multi-tenant environments and consume third-party service credits. **`CVE-2026-41279`** affects the unauthenticated text-to-speech endpoint at **`POST /api/v1/text-to-speech/generate`**, which could accept an arbitrary **`credentialId`** and use decrypted stored credentials such as OpenAI or ElevenLabs API keys to generate speech, enabling API credit abuse. In **Flowise Cloud**, **`CVE-2026-41267`** allows improper mass assignment during account registration, letting unauthenticated attackers inject server-managed fields and manipulate organization associations, ownership metadata, timestamps, and role mappings across tenants. Organizations running Flowise or Flowise Cloud should upgrade to **3.1.0** and review exposed chatflows, stored credentials, and tenant registration controls.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-56271** allows remote attackers to bypass authentication in **Flowise** by forging valid JWTs and impersonating arbitrary users, including administrators. The flaw affects versions before **3.1.0**, including **3.0.13** and earlier, and stems from weak hardcoded default JWT secrets plus default audience and issuer values in the enterprise passport authentication middleware. When the relevant JWT environment variables are not explicitly configured, Flowise falls back to publicly known defaults, effectively embedding insecure default credentials into the authentication path. The issue is rated **CVSS v3.1 9.8** and **CVSS v4.0 9.3** as remotely exploitable, and remediation guidance calls for upgrading to **Flowise 3.1.0 or later** and setting strong, unique JWT secrets along with custom audience and issuer values.
Jul 18, 2026