EUVD-2026-52855
GHSA-wch5-xp77-fxg4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the prerequisite of knowing a victim credential UUID; PR:N applies to the more severe unauthenticated callback/refresh paths; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table by id only; callback and refresh are whitelisted from authentication. This allows any authenticated user to initiate OAuth2 flows against credentials belonging to other workspaces, allows an unauthenticated attacker to forge OAuth2 callbacks to overwrite tokens in any credential, and allows an unauthenticated attacker to refresh tokens for any credential. The affected routes include /api/v1/oauth2-credential/authorize/<VICTIM_CREDENTIAL_UUID>, /api/v1/oauth2-credential/callback?code=ATTACKER_AUTH_CODE&state=<VICTIM_CREDENTIAL_UUID>, and /api/v1/oauth2-credential/refresh/<VICTIM_CREDENTIAL_UUID>. This issue is fixed in version 3.1.3.
AnalysisAI
Cross-workspace OAuth2 credential isolation failure in Flowise prior to version 3.1.3 enables two distinct attack classes: authenticated users can initiate OAuth2 flows against credentials owned by other workspaces, and - more critically - unauthenticated attackers can forge OAuth2 callbacks to overwrite tokens or trigger token refreshes for any credential system-wide by exploiting a whitelist that bypasses all authentication on the /callback and /refresh endpoints. The root cause is that all three OAuth2 handlers query the Credential table by credential ID alone, omitting the workspaceId isolation enforced elsewhere in the codebase. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The callback and refresh endpoints (/api/v1/oauth2-credential/callback and /api/v1/oauth2-credential/refresh) require no authentication whatsoever - they are explicitly whitelisted from JWT and API-key verification in constants.ts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N reflects the mixed nature of the attack surface: the AT:P (attack requirements present) captures the dependency on knowing a victim credential UUID, while PR:L acknowledges the authorize endpoint's authentication requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Flowise to version 3.1.3, the confirmed vendor-released patch per the GitHub release at https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Flowise instances in production and staging, document versions, and assess external network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTO
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today