Flowise CVE-2026-41266

Exploitation requires only knowledge of a valid chatflow UUID and network reachability to the Flowise HTTP API - no authentication, no user interaction (AV:N/AC:L/PR:N/UI:N). The UUID is the sole prerequisite and is frequently obtainable from embedded chat widgets, referrer headers, or logs. The concrete condition that yields secrets is that the target chatflow must actually contain sensitive values - specifically a node with a type:'password' field (e.g. the Unstructured API KEY in an S3 File node) or a Requests POST/GET node carrying an Authorization header; chatflows without such fields disclose only non-secret configuration. Limiting factors: the instance must be reachable by the attacker (internet-exposed self-host or Flowise Cloud multi-tenant), and affected versions are <= 3.0.13 (fixed in 3.1.0).

Signals are mixed but coherent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial, unauthenticated, low-complexity network access, and the vendor scored confidentiality impact as subsequent-system (SC:H, VC:N) - meaning the leaked artifacts are credentials for OTHER systems rather than the Flowise host itself, which is why base severity lands at 7.7 (High) despite no integrity or availability impact. SSVC reinforces attention: Exploitation=poc, Automatable=yes, Technical Impact=partial - a scriptable, mass-scannable disclosure. Counterweighting this, EPSS is only 0.05% (15th percentile) and there is no KEV listing, indicating no observed widespread exploitation yet. The one genuine limiting factor is that exploitation requires knowledge of a valid chatflow UUID; however the advisory notes UUIDs commonly leak via embedded chat widgets, referrer headers, and logs, so this is a weak barrier. Net: a real, low-effort priority for any internet-exposed or multi-tenant (Flowise Cloud) deployment, but only where chatflows actually store credentials in password fields or Requests-node headers.

An attacker harvests a chatflow UUID from a website's embedded Flowise chat widget (or a referrer/log entry), then issues a single unauthenticated request: curl -s https://target/api/v1/public-chatbotConfig/{UUID}. The response returns flowData containing plaintext values such as unstructuredAPIKey and a 'Bearer victim_token' Authorization header, which the attacker reuses to access the victim's upstream API and internal endpoints. A working PoC is published in the vendor advisory, and because the flaw is automatable, an attacker can scan many known UUIDs at scale.