EUVD-2026-25291
GHSA-x5w6-38gp-mrqh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A and AC:H because exploitation needs an adjacent-network MITM position; UI:R since the victim must initiate a reset and open the link; C:H/I:H for account takeover, A:N as availability is not directly impacted.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.com sends a reset password link over the unsecured HTTP protocol instead of HTTPS. This behavior introduces the risk of a man-in-the-middle (MITM) attack, where an attacker on the same network as the user (e.g., public Wi-Fi) can intercept the reset link and gain unauthorized access to the victim’s account. This vulnerability is fixed in 3.1.0.
AnalysisAI
Cleartext transmission of password reset links in Flowise (via cloud.flowiseai.com) prior to version 3.1.0 allows a network-positioned man-in-the-middle attacker to intercept the reset token and hijack a victim's account. The reset email embeds the link over plain HTTP instead of HTTPS, so anyone sharing the victim's network (e.g., public Wi-Fi) can sniff the token during a reset flow. Publicly available exploit code exists (HackerOne report #1888915), but EPSS is very low (0.03%, 10th percentile) and there is no evidence of active exploitation.
Technical ContextAI
Flowise is an open-source drag-and-drop builder for large-language-model (LLM) workflows; the affected component is the hosted cloud offering at cloud.flowiseai.com and the underlying npm package 'flowise' (CPE cpe:2.3:a:flowiseai:flowise). The root cause is CWE-319 (Cleartext Transmission of Sensitive Information): the account-recovery subsystem generates the forgot-password link with an http:// scheme rather than https://, so the single-use reset token traverses the wire unencrypted. Because password reset tokens are bearer credentials, any exposure of the token in cleartext is equivalent to exposing the credential itself. Best-practice mitigations that were absent include forcing HTTPS on all sensitive links and enforcing HSTS to prevent protocol downgrade.
RemediationAI
Vendor-released patch: 3.1.0 - upgrade Flowise to 3.1.0 or later (npm package flowise 3.1.0), which generates password reset links over HTTPS; see GHSA-x5w6-38gp-mrqh. For self-hosted operators who cannot immediately upgrade, terminate TLS in front of Flowise and configure the application/base URL to use https:// so reset links are emitted as HTTPS, and enable HTTP Strict Transport Security (HSTS) to block protocol downgrade - the trade-off is that HSTS requires a valid certificate on the mail-link domain and can break any legacy plain-HTTP access. As an operational compensating control, keep reset-token lifetimes short and invalidate tokens on first use to shrink the interception window; users on untrusted networks should avoid initiating password resets until patched. Users of cloud.flowiseai.com are covered by the vendor's fix and need take no action.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTO
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today