Flowiseai Flowise vulnerabilities

CVE-2026-41270 [HIGH] CWE-284 CVE-2026-41270: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, an

CVE-2026-67620 [HIGH] CWE-918 CVE-2026-67620: Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard impleme Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET

CVE-2026-73484 [HIGH] CWE-184 CVE-2026-73484: Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.

CVE-2025-71335 [HIGH] CWE-613 CVE-2025-71335: Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions an Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their cred

CVE-2026-42863 [HIGH] CWE-284 CVE-2026-42863: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a ch

CVE-2026-70474 [HIGH] CWE-863 CVE-2026-70474: Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table by id only; callback and refresh are whitelisted from

CVE-2026-70476 [HIGH] CWE-284 CVE-2026-70476: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifyin

CVE-2026-70473 [HIGH] CWE-200 CVE-2026-70473: Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vect

CVE-2024-8182 [HIGH] CWE-400 CVE-2024-8182: An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user supplied input to the “/api/v1/get-upload-file” api endpoint.

CVE-2026-69257 [HIGH] CWE-918 CVE-2026-69257: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list. Because ipaddr.js reports these addresses as ipv6 while IPv4

CVE-2026-67621 [HIGH] CWE-862 CVE-2026-67621: Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated works Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document i

CVE-2026-69252 [HIGH] CWE-862 CVE-2026-69252: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the o

CVE-2026-56268 [HIGH] CWE-863 CVE-2026-56268: Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apike Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted (the default), the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key assigned, because the underlying

CVE-2025-29189 [HIGH] CWE-89 CVE-2025-29189: Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores. Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.

CVE-2026-41278 [HIGH] CWE-200 CVE-2026-41278: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization for public chatflows. Docker validation revealed this is worse than initially assessed: the sanitizeFlowDataForPublicEndpoint function does NOT exis

CVE-2026-41275 [HIGH] CWE-319 CVE-2026-41275: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.com sends a reset password link over the unsecured HTTP protocol instead of HTTPS. This behavior introduces the risk of a man-in-the-middle (MITM) attack, where an attacker on the same network as

CVE-2026-70475 [HIGH] CWE-862 CVE-2026-70475: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify exec

CVE-2026-41279 [HIGH] CWE-639 CVE-2026-41279: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId directly in the request body. When called without a chatflowId, the endpoint uses the provided credentialId to decrypt

CVE-2026-56275 [HIGH] CWE-918 CVE-2026-56275: Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node t Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the m

CVE-2026-41272 [HIGH] CWE-918 CVE-2026-41272: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of