SB2026083134 - Multiple vulnerabilities in Flowise

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026083134

SB2026083134 - Multiple vulnerabilities in Flowise

Published: August 31, 2026 Updated: September 1, 2026

Security Bulletin ID SB2026083134
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 53% Low 47%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to conduct stored cross-site scripting.

The vulnerability exists due to path traversal in the Sql Database Chain node when accepting a user-supplied sqlite file path. A remote user can supply a crafted sqlite database path and write malicious HTML content into the frontend build directory to conduct stored cross-site scripting.

User interaction is required for a victim to visit the attacker-written HTML file served by the application.


2) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access internal network resources and disclose sensitive information.

The vulnerability exists due to improper sandbox restrictions in the NodeVM custom JavaScript function environment when E2B sandbox is not configured and custom JavaScript functions can require overly permissive dependencies. A remote user can use allowed browser automation or database libraries to access internal network resources and disclose sensitive information.

The issue affects the fallback NodeVM execution path when E2B sandbox is not configured.


3) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to manipulate LLM behavior and disclose sensitive information.

The vulnerability exists due to code injection in MCP tool descriptions passed into LangChain Tool objects when connecting to a malicious MCP server. A remote user can supply a poisoned MCP server description to manipulate LLM behavior and disclose sensitive information.

User interaction is required to configure Flowise to connect to the malicious MCP server.


4) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in an os command in the CustomMCP and SupergatewayMCP command validation logic when the server is started with CUSTOM_MCP_SECURITY_CHECK=false and a custom MCP node is executed. A remote user can configure a custom MCP node to run arbitrary commands to execute arbitrary code.

Exploitation requires the CUSTOM_MCP_SECURITY_CHECK environment setting to be disabled.


5) Cleartext storage of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to cleartext storage of sensitive information in the exportData() function and Variable entity export path when exporting workspace data. A remote user can export workspace data or obtain an export file to disclose sensitive information.

The issue exposes Flowise Variable values such as API keys, database connection strings, and service tokens in plaintext.


6) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access internal network resources and disclose sensitive information.

The vulnerability exists due to server-side request forgery (SSRF) in the Cheerio, Playwright, and Puppeteer document loader nodes when fetching user-provided URLs. A remote user can supply a specially crafted URL to access internal network resources and disclose sensitive information.

Response content is returned as document text, and cloud metadata endpoints and other private network resources may be reachable.


7) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: N/A)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper neutralization of special elements used in a NoSQL command in MongoDBMemory node when handling Prediction API requests with a crafted overrideConfig.sessionId value. A remote attacker can send a specially crafted request containing a MongoDB operator object to disclose sensitive information.

The issue can expose chat history records from arbitrary other users in a shared MongoDB collection, including sensitive data disclosed to the AI agent. Public chatflows can be reached without authentication through the prediction endpoint.


8) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject commands into GitHub Actions Docker image build workflows and disclose sensitive credentials.

The vulnerability exists due to command injection in GitHub Actions workflow_dispatch input handling in Docker image build workflows when processing user-supplied workflow inputs interpolated into run: blocks. A remote privileged user can supply crafted input containing shell metacharacters to inject commands into the workflow and disclose sensitive credentials.

Exploitation requires write access to the repository and the ability to trigger the affected workflows through workflow_dispatch. Exposed secrets may include AWS credentials, Docker Hub tokens, and an AWS OIDC IAM role.


9) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to perform server-side requests and disclose sensitive information, including LLM provider API keys.

The vulnerability exists due to server-side request forgery (SSRF) in chat-model nodes when processing user-controlled basepath or baseUrl values as the provider SDK baseURL. A remote user can create or update a chatflow with an attacker-controlled URL and trigger a prediction to perform server-side requests and disclose sensitive information, including LLM provider API keys.

The issue affects ChatOpenAICustom, both ChatOllama variants, ChatLocalAI, ChatLitellm, ChatNvdiaNIM, ChatNemoGuardrails, ChatCloudflareWorkersAI, and ChatGoogleGenerativeAI. The response from the outbound request can be returned through chat output, and the provider API key may be sent in the Authorization header. Publicly exposed prediction endpoints can broaden reach if a malicious chatflow is published.


10) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in GET /api/v1/organizationuser when handling authenticated requests for organization user records. A remote user can send a specially crafted request with a userId parameter to disclose sensitive information.

The issue exposes the organization owner\'s bcrypt password hash and may also expose tempToken and tokenExpiry fields; querying the requester\'s own userId can still return the owner\'s attached user record, and no victim interaction is required.


11) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in the Sql Database Chain node when accepting a user-supplied sqlite file path. A remote user can supply a crafted sqlite database path and trigger processing of attacker-controlled database content to execute arbitrary code.

Exploitation was demonstrated against the published Docker image and relied on writing a crafted sqlite database file into /etc/chromium so it would later be sourced by chromium as a shell script.


12) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose tool definitions, execute tools, and obtain tool outputs across workspace boundaries.

The vulnerability exists due to authorization bypass through a user-controlled key in the openai-realtime GET and POST endpoints when handling a supplied chatflow ID without verifying workspace ownership. A remote user can supply a victim chatflow ID to access another workspace\'s ChatFlow runtime objects and invoke associated tools to disclose tool definitions, execute tools, and obtain tool outputs across workspace boundaries.

Exploitation is limited to users or API keys within the same Flowise organization, and tool execution can trigger external side effects depending on the victim workspace configuration.


13) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation in validateMCPServerConfig() in packages/components/nodes/tools/MCP/core.ts when processing MCP server configuration. A remote user can supply a crafted cwd parameter to execute arbitrary code.

The issue arises because the cwd parameter is not validated before being passed to StdioClientTransport, allowing path validation checks on args to be bypassed.


14) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in an os command in the Custom MCP stdio configuration and command validation logic when processing user-supplied MCP server configuration through the customMCP node load method. A remote user can supply a crafted configuration that invokes npx package binaries to execute arbitrary code.

The configured process is spawned before Flowise determines whether the target is a valid MCP server, and the issue was validated against the official Docker image.


15) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain administrative access to another organization\'s workspaces and resources.

The vulnerability exists due to authorization bypass through user-controlled key in organization and workspace membership APIs when processing attacker-supplied organization and workspace identifiers. A remote user can send crafted API requests with another organization\'s IDs to gain administrative access to another organization\'s workspaces and resources.

Exploitation requires a valid authenticated session with management permissions in the attacker\'s own organization and no victim interaction.


16) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing authorization in the /api/v1/text-to-speech/abort endpoint when handling crafted abort requests with user-supplied chatflowId and chatId values. A remote attacker can send a specially crafted request to cause a denial of service.

The issue can terminate an in-progress chatflow prediction for another user and may also disrupt client-side UI state through server-sent events.


17) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from third-party resources across workspace boundaries.

The vulnerability exists due to authorization bypass through a user-controlled key in the node-load-method endpoint and credential resolution logic when invoking component load methods with an attacker-supplied credential ID. A remote user can send a specially crafted request using a credential ID from another workspace to disclose sensitive information from third-party resources across workspace boundaries.

The issue affects server-side use of credentials from a different workspace and can return provider metadata such as Google Drive files, Google Sheets spreadsheets, or AWS DynamoDB tables without exposing the raw credential secret.


Remediation

Install update from vendor's website.

References