EUVD-2026-38367Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires only a valid API key (PR:L); low confidentiality impact as only unprotected chatflow metadata is read-only disclosed; no integrity or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted (the default), the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key assigned, because the underlying query lacks any workspace filter. An attacker with a valid API key for one workspace can therefore retrieve the full ChatFlow configuration (including flowData with system prompts and node configurations, chatbotConfig, apiConfig, and credential IDs) of unprotected chatflows belonging to other workspaces.
AnalysisAI
Cross-workspace chatflow configuration disclosure in Flowise before 3.1.2 allows any holder of a valid API key for one workspace to read the full configuration of unprotected chatflows belonging to all other workspaces in the same instance. The /api/v1/chatflows/apikey/:apikey endpoint's database query omits a workspace scope filter when the keyonly parameter is absent (the default), causing it to return every chatflow system-wide where apikeyid is NULL or empty - including flowData, system prompts, chatbotConfig, apiConfig, and credential IDs from unrelated tenants. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability is trivially reproducible given the disclosed source code and standard HTTP tooling.
Technical ContextAI
Flowise is an open-source LLM workflow orchestration platform distributed as the npm package flowise (CPE: cpe:2.3:a:flowise:flowise:*:*:*:*:*:*:*:*). The vulnerable code resides in two files: the controller at packages/server/src/controllers/chatflows/index.ts:90-107 and the service at packages/server/src/services/chatflows/index.ts:223-245. The controller validates the caller's API key but then delegates data retrieval to a TypeORM QueryBuilder that, absent the keyonly query parameter, appends OR cf.apikeyid IS NULL OR cf.apikeyid = '' conditions with no workspaceId predicate. This means any authenticated API call using the default path returns a superset of data that crosses tenant/workspace boundaries. CWE-863 (Incorrect Authorization) is the correct root cause classification: the authorization gate (API key validation) passes, but the subsequent data access logic fails to enforce workspace-scoped authorization on what is returned.
RemediationAI
Upgrade Flowise to version 3.1.2 or later; this is the vendor-released patch confirmed by GHSA-c2c9-mfw7-p8hw and the npm package metadata. If an immediate upgrade is not feasible, the most targeted compensating control is to ensure that every chatflow in the instance has an explicit API key assigned (apikeyid not NULL and not empty), since only chatflows with no API key assigned are incorrectly leaked across workspace boundaries - this requires auditing all chatflows across all workspaces and has the operational trade-off of requiring API authentication for any chatflow previously accessible without a key. A second compensating control is to restrict network access to the Flowise API to trusted IP ranges or an internal network, which reduces the pool of potential attackers to those already on privileged segments but does not eliminate insider-tenant risk. References: vendor advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c2c9-mfw7-p8hw and VulnCheck advisory at https://www.vulncheck.com/advisories/flowise-cross-workspace-information-disclosure-via-chatflows-apikey-endpoint.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today