CVE-2026-41276: 
Flowise vulnerability analysis and mitigation

CVE-2026-41276 is an authentication bypass vulnerability in FlowiseAI Flowise, a drag-and-drop UI for building customized LLM workflows. The flaw exists in the resetPassword method of the AccountService class, allowing unauthenticated remote attackers to reset any user's password by submitting a null or empty string as the password reset token. All versions up to and including 3.0.13 are affected; the issue is fixed in version 3.1.0. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, ZDI Advisory).

The root cause is improper authentication (CWE-287): the resetPassword() method in packages/server/src/enterprise/services/account.service.ts retrieves a user's account by email and compares the submitted reset token against the stored value, but never verifies that a reset token was actually generated in the first place. By default, user.tempToken is null for accounts that have never requested a reset, or an empty string for accounts that have previously completed a reset — both of which an attacker can trivially submit. The attacker must also pass an expiry check; for accounts that have never requested a reset, the stored tokenExpiry defaults to account creation time plus 15 minutes (or the PASSWORD_RESET_TOKEN_EXPIRY_IN_MINUTES environment variable), meaning the attack window is limited to recently created accounts unless the token expiry has been extended. A public proof-of-concept Python script (poc.py) is available that automates the attack by first attempting a null token and then an empty string token against the /api/v1/account/reset-password endpoint (GitHub Advisory, ZDI Advisory).

Successful exploitation allows an unauthenticated attacker who knows a target user's email address to reset that user's password to an arbitrary value, gaining full unauthorized access to the Flowise account. Once authenticated, the attacker can access, modify, or delete LLM flows, API keys, credentials, and integrated data sources configured within the platform, resulting in high confidentiality, integrity, and availability impact. In enterprise deployments where Flowise is integrated with sensitive AI pipelines, external APIs, or data stores, account takeover could facilitate lateral movement into connected systems (GitHub Advisory, ZDI Advisory).

A proof-of-concept Python exploit (poc.py) is publicly documented in the GitHub Security Advisory, with concrete reproduction steps including specific HTTP endpoints and payloads (GitHub Advisory). The ZDI advisory (ZDI-26-300) was published on April 27, 2026, and was discovered by Nicholas Zubrisky of TrendAI Research at Trend Micro (ZDI Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0022 (0.22%), reflecting low but non-negligible exploitation probability given the public PoC (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Flowise instances (versions ≤ 3.0.13) using tools like Shodan or Censys, searching for services on port 3000/TCP. Obtain the email address of a target user through OSINT, phishing, or enumeration.
2. Identify target account timing: For accounts that have never requested a password reset, the exploit window is limited to 15 minutes after account creation (or the configured PASSWORD_RESET_TOKEN_EXPIRY_IN_MINUTES value). For accounts that have previously reset their password, the stored tempToken is an empty string with no expiry constraint, making them permanently exploitable.
3. Send null token reset request: Submit a POST request to /api/v1/account/reset-password with a JSON body containing the target's email, a null value for the reset token field, and the desired new password (e.g., TMSR1234!).
4. Fallback to empty string token: If the null token request fails, resend the same POST request with the reset token field set to an empty string ("") instead of null.
5. Authenticate as victim: Use the newly set password to log in to the Flowise web interface or API as the compromised user, gaining full access to their LLM flows, credentials, and integrated resources (GitHub Advisory, ZDI Advisory).

• Network: Unexpected POST requests to /api/v1/account/reset-password from external or unknown IP addresses, especially without a preceding request to /api/v1/account/forgot-password from the same source; repeated requests with null or empty token values in the JSON body.
• Logs: Flowise application logs showing successful password reset operations (200 OK responses to /api/v1/account/reset-password) not correlated with a prior forgot-password request from the same user session; session invalidation events (destroyAllSessionsForUser) triggered unexpectedly.
• Authentication Events: Logins from unfamiliar IP addresses or geolocations shortly after an unexpected password reset event; multiple failed login attempts followed by a successful login after a reset.
• Application State: User accounts with tempToken set to empty string and tokenExpiry cleared unexpectedly; user status changed to ACTIVE without a corresponding user-initiated reset flow (GitHub Advisory).

Upgrade FlowiseAI Flowise to version 3.1.0 or later, which contains the fix for this vulnerability (GitHub Advisory). As a temporary workaround for organizations unable to upgrade immediately, restrict network-level access to the /api/v1/account/reset-password endpoint via firewall rules or a reverse proxy, allowing only requests originating from trusted networks. Additionally, implement rate limiting and logging on the password reset endpoint to detect and throttle abuse attempts.

The vulnerability was discovered by Nicholas Zubrisky of TrendAI Research at Trend Micro and reported through the Zero Day Initiative program, which published advisory ZDI-26-300 on April 27, 2026 (ZDI Advisory). Check Point also published a defense advisory (CPAI-2026-4390) referencing this vulnerability. No significant broader community or social media discussion has been identified beyond standard vulnerability database aggregation.