Flowise CVE-2026-56271

The specific prerequisite is that the target runs the Flowise enterprise passport authentication middleware with one or more of the JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, or JWT_ISSUER environment variables left unset, which triggers the silent fallback to the hardcoded defaults 'auth_token', 'refresh_token', 'AUDIENCE', and 'ISSUER'. When that condition holds, exploitation is remote and unauthenticated (PR:N/UI:N) against the reachable authentication endpoints. The limiting factor is deployment configuration: an operator who has explicitly configured strong, unique values for all four variables is not exploitable, so realistic risk is confined to instances running with default or incomplete JWT environment configuration.

All available signals point to genuine high priority rather than an inflated CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes remote, network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability, which matches the described full administrator impersonation. No EPSS score, SSVC decision, or CISA KEV entry was provided in the input, so probabilistic exploitation likelihood and automatability cannot be quantified from this data. There is no evidence of active exploitation (not in KEV) and no public exploit identified at time of analysis, so this is not confirmed in-the-wild. The one meaningful limiting factor the raw vector does not capture is that exploitation requires the deployment to have left the four JWT environment variables unset - a plausible default or misconfiguration for the enterprise auth feature but not guaranteed on every instance; a hardened deployment that sets strong secrets is not vulnerable.

An attacker who can reach a Flowise instance's login or API endpoints reads the publicly known default secret and claim values from the open-source repository, crafts a JWT signed with 'auth_token' carrying an administrator's identity plus the 'AUDIENCE'/'ISSUER' claims, and presents it to the server. Because the middleware validates against the same hardcoded defaults, the forged token is accepted and the attacker gains administrative access without any credentials or user interaction. No public exploit code has been identified, but the low attack complexity means a working forgery is trivial to build.