EUVD-2026-54172
GHSA-rm9r-9424-cccf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no privileges required per auth bypass; integrity high from unauthorized token rotation; no confidentiality or availability impact per CVSS 4.0 source data.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation against credentials belonging to any workspace and potentially disrupting dependent OAuth integrations. This is a bypass of CVE-2026-41273.
AnalysisAI
Unauthenticated OAuth token rotation in Flowise through 3.1.4 allows any network-reachable attacker to force OAuth credential refresh against credentials belonging to any workspace by exploiting incomplete prefix-based whitelist matching in the authentication middleware. The authentication bypass targets the OAuth2 credential refresh endpoint, where appending a trailing credential identifier satisfies the prefix check without triggering authorization logic. This is a confirmed bypass of CVE-2026-41273, meaning a prior patch for the same middleware was incomplete. No public exploit identified at time of analysis from KEV, though a public advisory with technical detail exists via the Caycon GitHub repository, and the product has been announced as sunset.
Technical ContextAI
Flowise is an open-source drag-and-drop LLM flow builder built on Node.js. The authentication middleware in packages/server/src/utils/constants.ts implements a whitelist of routes exempt from authentication using prefix-based string matching. The root cause is CWE-862 (Missing Authorization): when a route is checked against this whitelist using prefix matching rather than exact or regex matching, an attacker can construct a URL that begins with a whitelisted prefix (the OAuth2 credential refresh route) followed by an arbitrary trailing path segment (a credential identifier). The server routes this to the OAuth2 refresh handler, which executes the token rotation against the credential ID embedded in the request path, without having verified the caller's identity or authorization to act on that credential. This is specifically a bypass of the fix applied for CVE-2026-41273, indicating the prior patch hardened one pattern but left the prefix-matching logic structurally intact. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms no prerequisites, no complexity, and no privileges required.
RemediationAI
No vendor-released patch identified at time of analysis - the product has been announced as sunset at https://flowiseai.com/sunset, making an official fix unlikely. The primary recommended action is to decommission Flowise and migrate OAuth credential management to an actively maintained alternative. If immediate migration is not possible, the following compensating controls apply with noted trade-offs: (1) Place Flowise behind a network perimeter or authenticated reverse proxy (e.g., require mutual TLS or SSO at the ingress layer) to prevent unauthenticated network access to the OAuth2 refresh endpoint - this adds operational overhead but eliminates the network attack surface. (2) Disable or remove OAuth2 credential configurations from all Flowise workspaces to eliminate the rotatable targets - this breaks any OAuth-dependent flows but removes the integrity risk. (3) Restrict access to the Flowise instance to specific trusted IP ranges via firewall rules, reducing exposure to internal actors only. Review the technical advisory at https://github.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-70636.md for middleware-level workaround details that may allow a manual patch to constants.ts by replacing prefix matching with exact-match or regex route whitelisting.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today