Loading vulnerability…
Authentication Bypass via Hardcoded JWT Secrets in Flowise Enterprise Passport Middleware
CVE-2026-56271 is an authentication-bypass vulnerability in Flowise Enterprise Passport authentication middleware affecting versions before 3.1.0, including 3.0.13 and earlier. When JWT-related environment variables are unset, the middleware silently uses publicly known hardcoded fallback signing secrets and audience and issuer values rather than failing securely. An unauthenticated remote attacker can use those defaults to forge JWTs accepted by Flowise and impersonate arbitrary users, including administrators.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in authentication bypass and administrative compromise of the affected Flowise instance. An attacker with forged administrator access can read workflows and configurations, obtain stored API keys and other integration credentials, modify or delete pipelines, and access connected data sources, vector databases, and external APIs.
If you can’t patch tonight, do this now.
If an immediate upgrade is not possible, explicitly configure high-entropy, unique values for JWT_AUTH_TOKEN_SECRET and JWT_REFRESH_TOKEN_SECRET, and configure unique JWT_AUDIENCE and JWT_ISSUER values. Restrict exposure of affected enterprise authentication functionality until patched. If the instance previously operated using defaults, invalidate existing sessions and rotate stored API keys and other credentials.
Patch, then assume compromise.
Upgrade Flowise to version 3.1.0 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.