Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
97 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated users to control the primary key (id) and internal state fields of DocumentStore entities. Because the service uses repository.save() with a client-supplied primary key, the POST create endpoint behaves as an implicit UPSERT operation. This enables overwriting existing DocumentStore objects. In multi-workspace or multi-tenant deployments, this can lead to cross-workspace object takeover and broken object-level authorization (IDOR), allowing an attacker to reassign or modify DocumentStore objects belonging to other workspaces. Details The DocumentStore entity defines a globally unique primary key: The create logic is implemented as: Here is no DTO allowlist or field filtering before persistence. The entire request body is mapped directly to the entity. TypeORM save() behavior: 1. If the primary key (id) exists → UPDATE 2. If not → INSERT Because id is accepted from the client, the…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ZDI-CAN-28762: Flowise AccountService resetPassword Authentication Bypass Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ Version tested: 3.0.12 Installer file: hxxps://github.com/FlowiseAI/Flowise Platform tested: NA --- Analysis This vulnerability allows remote attackers to bypass authentication on affected installations of FlowiseAI Flowise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetPassword method of the AccountService class. The issue results from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to change user's passwords and bypass authentication on the system. Product information FlowiseAI Flowise version 3.0.12 (hxxps://github.com/FlowiseAI/Flowise) Setup Instructions Root Cause…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion. Vulnerability Details | Field | Value | |-------|-------| | Affected File | packages/components/nodes/chains/GraphCypherQAChain/GraphCypherQAChain.ts | | Affected Lines | 193-219 (run method) | Prerequisites To exploit this vulnerability, the following conditions must be met: 1. Neo4j Database: A Neo4j instance must be connected to the Flowise server 2. Vulnerable Chatflow Configuration: - A chatflow containing the Graph Cypher QA Chain node - Connected to a Chat Model (e.g., ChatOpenAI) - Connected to a Neo4j Graph node with valid credentials 3. API Access: Access to the chatflow's prediction endpoint (/api/v1/prediction/{flowId}) <img width="1627" height="1202"…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The password reset functionality on cloud.flowiseai.com sends a reset password link over the unsecured HTTP protocol instead of HTTPS. This behavior introduces the risk of a man-in-the-middle (MITM) attack, where an attacker on the same network as the user (e.g., public Wi-Fi) can intercept the reset link and gain unauthorized access to the victim’s account. Steps to Reproduce: 1. Sign up for a new account on https://cloud.flowiseai.com/register. 2. Navigate to the https://cloud.flowiseai.com/forgot-password page and enter your email. 3. Open your inbox and locate the password reset email. 4. Copy the reset link and inspect its protocol – it uses http:// instead of https://. POC:…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow. By accessing a public chatflow configuration endpoint, an attacker can retrieve internal workflow data, including OAuth credential identifiers, which can then be used to refresh and obtain valid OAuth 2.0 access tokens without authentication. Details Flowise is designed to allow public chatflows to be accessed by unauthenticated end users via public URLs or embedded widgets. As a result, chatflowId values are intentionally exposed to unauthenticated clients and must not be treated as secrets. However, the endpoint GET /api/v1/public-chatbotConfig/<chatflowId returns internal flowData without authentication. The returned flowData includes workflow node definitions containing OAuth credential identifiers (credential field). Separately, the endpoint POST /api/v1/oauth2-credential/refresh/<credentialId allows OAuth.…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass the intended API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration. Details The vulnerability is located in FlowiseAI's API Chain implementation where user-controlled input is used to dynamically generate URLs and request parameters without proper validation. The attack works as follows: 1. Dynamic API Generation: Flowise's POST/GET API chains use LLM-generated prompts based on user queries and API documentation to construct HTTP requests 2. Unvalidated URL Construction: The system extracts URL and data parameters directly from LLM responses without validating against the intended API…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. Details The flaws exist in packages/components/src/httpSecurity.ts. Default Insecure: If process.env.HTTPDENYLIST is undefined, checkDenyList returns immediately, allowing all requests (including localhost). DNS Rebinding (TOCTOU): The function performs a DNS lookup (dns.lookup) to validate the IP, and then the HTTP client performs a new lookup to connect. An attacker can serve a valid IP first, then switch to an internal IP (e.g., 127.0.0.1) for the second lookup. PoC Ensure HTTPDENYLIST is unset (default behavior). Use any node utilizing secureFetch to access http://127.0.0.1. Result: Request succeeds. Scenario 2: DNS Rebinding Attacker controls…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTPDENYLIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services) Details The vulnerability exists in the sandbox configuration within packages/components/src/utils.ts Vulnerable Code - Allowed Built-in Modules (Line 56): SSRF Protection Implementation (Lines 254-261): Root Cause: - The secureWrappers object only contains mocked versions of axios and node-fetch that enforce HTTPDENYLIST - The built-in http, https, and net modules are passed directly to the sandbox via builtinDeps without any SSRF protection - Users can import these modules directly and make arbitrary HTTP requests, which…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In FlowiseAI, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally allow JavaScript uploads. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). Details This is a bypass of GHSA‑35g6‑rrw3‑v6xc (CVE‑2025‑61687). The Chatflow file upload settings do not properly validate MIME types. An attacker can add the application/javascript MIME type when updating a Chatflow, allowing .js files to be uploaded. JavaScript files are not listed as an option for file upload types within web user interface: <img width="1162" height="440" alt="Screenshot 2026-01-08 152306" src="https://github.com/user-attachments/assets/f33f04af-877e-4aac-95a7-86d4684891de" / PoC shell.js (Node.js Web Shell) Python Upload Script <img width="839" height="231" alt="image"…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODEOPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. Details The vulnerability is in a validation check within the replaceInputsWithConfig function within packages/server/src/utils/index.ts. The check for FILE-STORAGE:: was intended to handle file-type inputs but has three issues: 1. Uses .includes() instead of .startsWith(): The check passes if FILE-STORAGE:: appears ANYWHERE in the string, not just at the beginning. A remote user can embed it in a comment: / FILE-STORAGE:: / { custom config } 2. No parameter type validation: The check doesn't verify that the parameter is actually…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
/api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. Details Knowledge of chatflow UUID can be obtained from embedded chat widgets, referrer headers or logs and it's the only prerequest. getSinglePublicChatbotConfig function in packages/server/src/services/chatflows/index.ts returns the full flowData object without authorization check or data sanitization. There is a comment as "Safe as public endpoint as chatbotConfig doesn't contain sensitive credential" but flowData does contain sensitive data such as: type: 'password' fields are stored in plaintext (unstructuredAPIKey in S3File node). HTTP Authorization headers in POST / GET Requests nodes. Internal API endpoints and webhook URLs. PoC - Add an S3 File…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during account creation. This enables client-controlled manipulation of ownership metadata, timestamps, organization association, and role mappings, breaking trust boundaries in a multi-tenant environment. Details The POST /api/v1/account/register endpoint is intended to accept a minimal payload to create a new user account (e.g., name, email, password). However, the backend fails to enforce a strict allowlist or DTO-based validation and instead blindly maps client-supplied JSON to internal domain models. As a result, attackers can include additional nested objects and server-managed fields in the request body such as organization, organizationUser, workspace, workspaceUser, and metadata fields like createdBy, updatedBy, createdDate, and updatedDate. These fields are persisted as…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide the following payload: DataFrame({'foo': ['bar!']});import os;os.system('whoami') that will get interpolated and executed by the server. Details The code in question that introduces the issue is in CSVAgent.ts. customReadCSVFunc is user-controlled and gets interpolated directly without sanitization into the code variable which gets executed by pyodide one line later in: dataframeColDict = await pyodide.runPythonAsync(code). An authenticated attacker can issue the following chain of requests: 1. Create a new chat flow by sending a POST request to /api/v1/chatflows. This will return the chatflowId in the response. 2. Send a POST request to /api/v1/prediction/[CHATFLOWID] to trigger the execution of the chatflow. NOTE: the chatflow can contain only this node in order for the exploit to work. 3. Optionally: send a DELETE request to /api/v1/chatflows to cleanup and…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Summary “AirtableAgent” is an agent function provided by FlowiseAI that retrieves search results by accessing private datasets from airtable.com. “AirtableAgent” uses Python, along with Pyodide and Pandas, to get and return results. The user’s input is directly applied to the question parameter within the prompt template and it is reflected to the Python code without any sanitization. The point is that an attacker can bypass the intended behavior of the LLM and trigger Remote Code Execution through a simple prompt injection. About Airtable The airtable.ts function retrieves and processes user datasets stored on Airtable.com through its API. The usage of Airtable is as shown in the image above. After creating a Chatflow like above, you can ask data-related questions using prompts and receive answers. Details Airtable retrieves results by accessing datasets from airtable.com. When retrieving data, it is fetched as a JSON object encoded in base64. Then, when loading data, it…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The attacker provides an intranet address through the base url field configured in the Execute Flow node → Bypass checkDenyList / resolveAndValidate in httpSecurity.ts (not called) → Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detect internal network services Details <img width="1280" height="860" alt="9a52a74e6fe2fd78e4962d1d68057fc2" src="https://github.com/user-attachments/assets/20df0006-9129-4886-8928-16d19a617c23" / Then initiate the call: Server received a request: <img width="1432" height="172" alt="f45c757fec408e13739db068252ff21b" src="https://github.com/user-attachments/assets/d3dfe0f5-83ec-4c79-ab32-754382a68d5f" / And there is an echo: <img width="1280" height="666" alt="fa0caf0deb306cfeeea8fdf8941a287e" src="https://github.com/user-attachments/assets/55a94d25-120b-4e9c-9517-46c2fc2b667f" / Fix: Call secureFetch for verification Impact This is a Server-Side Request Forgery (SSRF) vulnerability that may…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise introduced SSRF protections through a centralized HTTP security wrapper (httpSecurity.ts) that implements deny-list validation and IP pinning logic. However, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axiosInstead of using the secured wrapper. Because enforcement is neither mandatory nor centralized, these tools bypass SSRF mitigation entirely, restoring full SSRF capability even after the patch. This issue is distinct from specification trust issues and represents incomplete mitigation of previously addressed SSRF vulnerabilities. Details Intended Security Model: All outbound HTTP requests should pass through the centralized validation layer implemented in: This layer performs: - HTTPDENYLIST enforcement - IP resolution validation - IP pinning - Loopback blocking Observed Implementation Gap: Multiple tools bypass this layer and import HTTP libraries directly. Examples include: -…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Faiss and SimpleStore (LlamaIndex) vector store implementations accept a basePath parameter from user-controlled input and pass it directly to filesystem write operations without any sanitization. An authenticated attacker can exploit this to write vector store data to arbitrary locations on the server filesystem. Vulnerability Details | Field | Value | |-------|-------| | Affected File | packages/components/nodes/vectorstores/Faiss/Faiss.ts (lines 79, 91) | | Affected File | packages/components/nodes/vectorstores/SimpleStore/SimpleStore.ts (lines 83-104) | Prerequisites 1. Authentication: Valid API token with documentStores:upsert-config permission 2. Document Store: An existing Document Store with at least one processed chunk 3. Embedding Credentials: Valid embedding provider credentials (e.g., OpenAI API key) Root Cause Faiss (Faiss.ts) SimpleStore (SimpleStore.ts) Impact An authenticated attacker can: 1. Write files to arbitrary locations on the server filesystem 2.…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Location | packages/server/src/enterprise/utils/tempTokenUtils.ts:31-34 | | Practical Exploitability | Medium | | Developer Approver | faizan@kolega.ai | Description The encryption key for token encryption has a weak default value 'Secre$t' when TOKENHASHSECRET environment variable is not set. Affected Code Evidence The default value 'Secre$t' is hardcoded in the source code and is cryptographically weak. This key is used to encrypt user IDs and workspace IDs in JWT tokens. Impact Token forgery - attackers can decrypt and manipulate encrypted token metadata, potentially changing user IDs or workspace IDs to escalate privileges or access unauthorized data. Recommendation Require TOKENHASHSECRET to be set as a strong random value in environment variables. Throw an error on startup if not configured. Use a minimum of 32 bytes of entropy. Notes The TOKENHASHSECRET has a weak hardcoded default 'Secre$t' (lines…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Location | packages/server/src/enterprise/middleware/passport/index.ts:55 | | Practical Exploitability | High | | Developer Approver | faizan@kolega.ai | Description Express session secret has a weak default value 'flowise' when EXPRESSSESSIONSECRET is not set. Affected Code Evidence The default session secret 'flowise' is publicly visible and weak. Session cookies signed with this secret can be forged by attackers. Impact Session hijacking and forgery - attackers can create arbitrary session cookies to impersonate any user, bypassing all authentication mechanisms. Recommendation Require EXPRESSSESSIONSECRET to be set with a strong random value. Throw an error on startup if not configured. Use cryptographically strong random strings (minimum 256 bits). Notes The Express session secret defaults to the string 'flowise' when EXPRESSSESSIONSECRET is not set (line 55). This secret is used to sign session cookies…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Severity | Critical | | Location | packages/server/src/enterprise/middleware/passport/index.ts:29-34 | | Practical Exploitability | High | | Developer Approver | faizan@kolega.ai | Description JWT secrets have weak hardcoded defaults ('authtoken', 'refreshtoken', 'AUDIENCE', 'ISSUER'). Attackers can forge valid JWTs and impersonate any user. Affected Code Evidence All JWT defaults are weak strings. Refresh token falls back to auth token which is a design flaw. If any environment variable is unset, weak default is used. Impact Complete authentication bypass. Attackers can forge valid JWTs for any user account. No authentication required to access protected endpoints. Can escalate to admin access. Recommendation Remove all default secrets - require all JWT environment variables to be explicitly set. Add startup validation throwing error if any JWT secret is missing. Use cryptographically random secrets (256+…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
I have discovered a critical Missing Authentication vulnerability on the /api/v1/loginmethod endpoint. The API allows unauthenticated users (guests) to retrieve the full SSO configuration of any organization by simply providing an organizationId. The response includes sensitive OAuth credentials (Client Secrets) in cleartext. PoC The following request can be sent by anyone on the internet without any cookies or authorization headers. Request Response: The server returns 200 OK with sensitive credentials: Affected Deployments - FlowiseAI Cloud (cloud.flowiseai.com) - Self-hosted FlowiseAI instances where the /api/v1/loginmethod endpoint is exposed Impact An unauthenticated attacker can harvest sensitive API secrets (Google, Microsoft, GitHub Client Secrets) from any organization on the cloud platform. This leads to complete compromise of the organization's third-party integrations and potential data breaches.
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. Details The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. https://github.com/FlowiseAI/Flowise/blob/d848baeb6bd9737a1e7fc912349c45fbdcc7bb38/packages/components/nodes/tools/MCP/core.ts#L223…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. Impact includes: - Access to internal admin panels (e.g., internal company dashboards, Jenkins, Kubernetes API, etc.). - Retrieval of cloud provider metadata (e.g., AWS IMDSv1 at [http://169.254.169.254], GCP, Azure). - Port scanning and enumeration of internal services. - Potential lateral movement or privilege escalation in compromised environments. This vulnerability is particularly severe because: - Flowise instances are often deployed publicly without authentication…
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Missing Authentication on NVIDIA NIM Endpoints Summary The NVIDIA NIM router (/api/v1/nvidia-nim/) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. Vulnerability Details | Field | Value | |-------|-------| | CWE | CWE-306: Missing Authentication for Critical Function | | Affected File | packages/server/src/utils/constants.ts | | Affected Line | Line 20 ('/api/v1/nvidia-nim' in WHITELISTURLS) | | CVSS 3.1 | 8.6 (High) | Root Cause In packages/server/src/utils/constants.ts, the NVIDIA NIM route is added to the authentication whitelist: This causes the global auth middleware to skip authentication checks for all endpoints under /api/v1/nvidia-nim/. None of the controller actions in packages/server/src/controllers/nvidia-nim/index.ts perform their own authentication checks. Affected Endpoints | Method | Endpoint | Risk | |--------|----------|------| | GET |…
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Flowise platform has a critical Insecure Direct Object Reference (IDOR) vulnerability combined with a Business Logic Flaw in the PUT /api/v1/loginmethod endpoint. While the endpoint requires authentication, it fails to validate if the authenticated user has ownership or administrative rights over the target organizationId. This allows any low-privileged user (including "Free" plan users) to: 1. Overwrite the SSO configuration of any other organization. 2. Enable "Enterprise-only" features (SSO/SAML) without a license. 3. Perform Account Takeover by redirecting the authentication flow. Details The backend accepts the organizationId parameter from the JSON body and updates the database record corresponding to that ID. There is no middleware or logic check to ensure request.user.organizationId === body.organizationId. PoC Prerequisites: 1. The attacker creates a standard "Free" account and obtains a valid JWT token (Cookie/Header). 2. The attacker identifies the target…
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.