DeutschShown in its original language — a full translation is planned for a future version.
Flowise: Mehrere Schwachstellen
view advisory published 2026-04-15
Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.
01
describes (25)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56271US | —OT elevated | — | ||
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENC… | ||||
| CVE-2026-56273US | — | — | ||
Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated us… | ||||
| CVE-2026-56278US | —OT elevated | — | ||
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET envi… | ||||
| CVE-2026-56270US | high7.5OT elevated | — | ||
Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve… | ||||
| CVE-2026-56269US | —OT elevated | — | ||
Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variable in packages/ser… | ||||
| CVE-2026-56275US | high7.1 | — | ||
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet address… | ||||
| CVE-2026-43995US | critical9.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (… | ||||
| CVE-2026-41274US | critical9.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the… | ||||
| CVE-2026-41279US | high7.5 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generat… | ||||
| CVE-2026-41278US | high7.5 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1/public-chatflows/:id endpoint returns the full chatflow obj… | ||||
| CVE-2026-41277US | high8.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allo… | ||||
| CVE-2026-41276US | critical9.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, this vulnerability allows remote attackers to bypass authentication on affe… | ||||
| CVE-2026-41275US | high7.5OT elevated | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.com sends a reset passw… | ||||
| CVE-2026-41273US | high8.2OT elevated | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contains an authentication bypass vulnerability that allows an unau… | ||||
| CVE-2026-41272US | — | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to… | ||||
| CVE-2026-41271US | high8.3 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's PO… | ||||
| CVE-2026-41270US | high8.3 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists… | ||||
| CVE-2026-41269US | high8.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow th… | ||||
| CVE-2026-41268US | critical9.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command executio… | ||||
| CVE-2026-41267US | critical9.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON injection) vulnerability in the account r… | ||||
showing 20 of 25
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-28g4-38q8-3cwc vom 2026-04-15external
- GitHub Security Advisory GHSA-2qqc-p94c-hxwh vom 2026-04-15external
- GitHub Security Advisory GHSA-2x8m-83vc-6wv4 vom 2026-04-15external
- GitHub Security Advisory GHSA-3hjv-c53m-58jj vom 2026-04-15external
- GitHub Security Advisory GHSA-3prp-9gf7-4rxx vom 2026-04-15external
- GitHub Security Advisory GHSA-48m6-ch88-55mj vom 2026-04-15external
- GitHub Security Advisory GHSA-4jpm-cgx2-8h37 vom 2026-04-15external
- GitHub Security Advisory GHSA-5fw2-mwhh-9947 vom 2026-04-15external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan