2026-08-08 · view entry permalink →
Flowise ships three new CVEs into a sunset, an unauthenticated auth bypass that defeats an earlier fix, and cross-workspace credential access, with no vendor left to patch them
Flowise, the open-source visual builder for LLM and AI-agent workflows, picked up three CVEs on 2026-08-06, and all three CVE records list the vendor's own sunset announcement (FlowiseAI) among their advisory references, which is the detail that turns a routine batch into an architecture decision.
The one that matters most needs no account. Per the assigning CNA, "Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts", a POST to the OAuth2 credential-refresh route with a trailing credential identifier appended slips past a check that only compares path prefixes, triggering unauthorised OAuth token rotation against credentials belonging to any workspace and potentially breaking dependent integrations (VulnCheck, 2026-08-07). CVE-2026-70636 is scored CVSS 4.0 8.7 with integrity-only impact (VC:N/VI:H/VA:N) and, notably, "This is a bypass of CVE-2026-41273"; the same route has been fixed once already and the fix was incomplete (VulnCheck, 2026-08-07).
The other two need an account but cross a tenancy boundary. CVE-2026-67622 (CWE-639, CVSS 4.0 8.5) is an insecure direct object reference in the OpenAI Assistants integration: an authenticated attacker supplies an arbitrary credential UUID to Assistants endpoints, the credential lookup performs no workspace-ownership check, and the attacker can enumerate cross-workspace assistant metadata, retrieve file and vector-store listings, and upload files into a victim workspace (VulnCheck, 2026-08-07). CVE-2026-67621 (CWE-862, CVSS 4.0 7.2) lets a member holding only view-level permissions call the document-store upsert and refresh routes directly to trigger ingestion, refresh vector-database contents, consume embedding API credits and modify knowledge bases that downstream chatflows depend on (VulnCheck, 2026-08-07). Germany's BSI CERT-Bund carried all three on 2026-08-06 with the summary that an attacker can exploit multiple Flowise vulnerabilities to bypass security measures, disclose information and manipulate data, marking the advisory unpatched with no fixed release listed (BSI CERT-Bund, 2026-08-06).
No party reports exploitation of any of the three. What makes this more than a routine batch is that the usual next step does not exist: with the company winding down commercial operations, an operator waiting for a fixed release is waiting for something nobody has committed to ship, and the code remaining available for community forks is not the same thing as a maintained security response. Self-hosted AI-agent orchestration platforms have been a recurring source of pre-authentication paths (this pipeline has covered three separate confirmed-exploited Langflow flaws since mid-July) and Flowise now belongs to the subset of that class where the only remaining controls are ones the operator builds.
Detection concept: for CVE-2026-70636 the network-visible shape is an unauthenticated POST to an OAuth2 credential-refresh path carrying an extra trailing path segment beyond the route the allow-list was written for, with the resulting token rotation appearing in the OAuth provider's audit log as a refresh nobody initiated. For the two authenticated flaws, the tell is a session enumerating credential UUIDs or Assistants endpoints outside its own workspace, and a view-only account issuing document-store upsert or refresh calls at all. Hardening, in the absence of a patch: terminate the credential-refresh route at a reverse proxy that enforces authentication independently of the application, scope each workspace's provider credentials so a cross-workspace read yields keys that are separately revocable, and treat any internet-exposed Flowise instance as a candidate for removal from the perimeter rather than for patching.
Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts.
This is a bypass of CVE-2026-41273.
Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen und Daten zu manipulieren.
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.
The earlier entry recorded three VulnCheck-assigned Flowise CVEs whose advisory links pointed at the vendor's own sunset announcement, with BSI marking its advisory unpatched and no vendor left to fix them; the operational conclusion being that self-hosted operators owned the compensating controls. A fourth CVE has now landed and it inverts that conclusion in one respect.
VulnCheck assigned CVE-2026-73487 on 2026-08-13 at CVSS 9.0, with the vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N. Flowise before 3.1.3 contains a regex-based Python code-validator bypass in the CSV and Airtable Agent nodes that lets unauthenticated attackers inject code via prompt injection, exploiting unblocked pandas functions such as pd.read_json() to exfiltrate datasets, perform server-side request forgery against internal services, or achieve code execution through the unauthenticated prediction API (VulnCheck, 2026-08-13). The delta that matters operationally is the last field of the record: there is a fixed release, 3.1.3.
Two things are worth separating. The defect class is a familiar one for this product line (a denylist implemented as a regular expression over generated Python, defeated by reaching a function the pattern does not name) and it is the same shape as the earlier auth-middleware bypass that defeated a prefix-based allowlist. The reachability is what makes it more than an application bug: the injection travels through the prediction API, which takes untrusted natural-language input by design and needs no authentication, so the attacker's input reaches the validator without any credential step in between. An agent node that turns a prompt into executed pandas code is doing exactly what it was built to do; the control that was supposed to bound it is the validator, and the validator is what broke.
The vendor's broader position has not changed (the earlier entry's reasoning about a sunset product still governs the medium-term decision) but the immediate action for anyone still running Flowise is now an upgrade rather than a compensating control. Detection concepts, telemetry class first: in application-access telemetry, unauthenticated requests to the prediction API whose payloads reference pandas entry points or file and URL-loading functions rather than the question-shaped input the flow expects; in egress telemetry from the host running Flowise, outbound requests to internal addresses or metadata endpoints originating from the Flowise process, which is the server-side-request-forgery half of the same primitive; in process-execution telemetry, any child process of the Flowise runtime.