Flowise CVE-2026-73603

The target Flowise instance must be running a version prior to 3.1.4 and must be network-accessible to the attacker. The targeted chatflow must have text-to-speech configured with a stored credential (OpenAI or ElevenLabs API key). The attacker must know a valid chatflow UUID - this is the primary limiting factor, corresponding to AT:P in the CVSS 4.0 vector. No authentication is required (PR:N). No user interaction is needed. No special configuration beyond TTS being enabled on a chatflow is required. Exploitation is limited by UUID discovery: UUIDs are not publicly enumerable by default but may be exposed via shared links, logs, or referrer headers. Chatflows without TTS credentials configured are not exploitable through this specific vector.

The CVSS 4.0 score of 6.3 (Medium) reflects network accessibility with no required privileges or user interaction, but the AT:P (Attack Requirements: Present) metric acknowledges that exploitation depends on the attacker possessing a valid chatflow UUID - a meaningful but not prohibitive prerequisite. UUIDs are not secret by design in Flowise and can be exposed via shared chatflow links, browser history, logs, or targeted enumeration. The impact metrics (VI:L/VA:L) correctly capture a financial and operational harm: the victim's API quota is consumed without consent, potentially leading to service disruption or unexpected billing. There is no confidentiality impact since credentials are used but not exfiltrated. A public PoC exists in the GHSA advisory, which elevates practical exploitability beyond what the numeric score alone suggests. No CISA KEV listing exists, indicating exploitation has not been confirmed as active and widespread. EPSS data was not provided; risk is best characterized as medium-practical given the low technical barrier once a UUID is known, but not broadly automated due to the UUID prerequisite.

An attacker obtains a valid Flowise chatflow UUID - for example, from a publicly shared chatflow link or by enumerating common UUID formats - and sends a crafted unauthenticated POST request to /api/v1/text-to-speech/generate with that UUID and arbitrary text input. Flowise retrieves the private chatflow, extracts the stored OpenAI or ElevenLabs credential, and fulfills the TTS request, billing the API usage to the chatflow owner. A public PoC demonstrating this bash-based attack is included in the GHSA advisory.