EUVD-2026-25298
GHSA-5fw2-mwhh-9947
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint (PR:N/AV:N) but requires a valid non-attacker-controlled credentialId (AC:H); impact is resource/credit abuse of the provider (A:H) with no data disclosure or tampering (C:N/I:N).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId directly in the request body. When called without a chatflowId, the endpoint uses the provided credentialId to decrypt the stored credential (e.g., OpenAI or ElevenLabs API key) and generate speech. This vulnerability is fixed in 3.1.0.
AnalysisAI
Unauthenticated authorization-key abuse in FlowiseAI Flowise before 3.1.0 lets remote attackers invoke the whitelisted text-to-speech endpoint (POST /api/v1/text-to-speech/generate) with an attacker-supplied credentialId, causing the server to decrypt and use a victim's stored provider API key (OpenAI, ElevenLabs, Azure, Google) to generate speech at the victim's expense. The GitHub Security Advisory (GHSA-5fw2-mwhh-9947) includes Docker-based validation proving the code path executes without authentication, but there is no public exploit identified at time of analysis and it is not in CISA KEV. EPSS is very low (0.04%, 12th percentile), consistent with SSVC exploitation status of 'none'.
Technical ContextAI
Flowise is an open-source, low-code drag-and-drop builder for LLM orchestration flows that stores third-party provider credentials (API keys) encrypted at rest and decrypts them server-side when a flow needs them. The affected component is the TTS controller (packages/server/src/controllers/text-to-speech/index.ts), which is registered in WHITELIST_URLS (constants.ts line 41), bypassing authentication. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): when no chatflowId is supplied, the controller trusts the credentialId taken directly from the request body (bodyCredentialId at lines 58-64) instead of validating that the credential belongs to the flow/user making the request, so any decryptable stored credential can be referenced by ID. Affected CPE is cpe:2.3:a:flowiseai:flowise:*.
RemediationAI
Vendor-released patch: 3.1.0 - upgrade Flowise to 3.1.0 or later, which restricts the TTS endpoint so a body-supplied credentialId is no longer trusted without an associated chatflow. If immediate upgrade is not possible, apply the vendor's suggested compensating control by removing the /api/v1/text-to-speech/generate entry from WHITELIST_URLS so the endpoint enforces authentication, or reject requests that lack a chatflowId (return 401), per the advisory code guidance; the trade-off is that any legitimate unauthenticated TTS usage will break and clients must authenticate. As network-level mitigations, restrict access to the TTS endpoint and the Flowise admin surface to trusted networks/VPN and avoid exposing Flowise directly to the internet, and rotate any provider API keys (OpenAI, ElevenLabs, Azure, Google) stored in a Flowise instance that was internet-reachable while vulnerable. See https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5fw2-mwhh-9947.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today