CVE-2026-41279: 
Flowise vulnerability analysis and mitigation

CVE-2026-41279 is an authorization bypass vulnerability in Flowise, a drag-and-drop UI for building customized LLM workflows. The text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted for unauthenticated access and accepts an attacker-controlled credentialId in the request body. When invoked without a chatflowId, the endpoint decrypts and uses the stored credential (e.g., OpenAI or ElevenLabs API key) to generate speech, enabling unauthorized API usage. All Flowise versions up to and including 3.0.13 are affected; the vulnerability is fixed in version 3.1.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory).

The root cause is an authorization bypass through a user-controlled key (CWE-639). The vulnerable code in packages/server/src/controllers/text-to-speech/index.ts (lines 58–64) directly assigns the attacker-supplied credentialId from the request body when no chatflowId is present, bypassing any ownership or authentication check. The endpoint is explicitly listed in WHITELIST_URLS (packages/server/src/utils/constants.ts, line 41), meaning no authentication token is required to reach it. An attacker only needs to know or enumerate a valid credentialId to trigger decryption and use of the associated third-party API key (GitHub Advisory).

Successful exploitation allows unauthenticated attackers to consume API credits from victim-owned accounts on services such as OpenAI, ElevenLabs, Azure Cognitive Services, and Google Cloud TTS, potentially incurring significant financial costs for the victim. The advisory notes that when combined with a credential ID leak from a separate finding, the attack becomes trivially exploitable. While direct confidentiality and integrity impacts on the Flowise system itself are rated as none, the availability of the victim's third-party API services is effectively degraded through unauthorized consumption (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time. The GitHub security advisory (GHSA-5fw2-mwhh-9947) provides root cause analysis and a code snippet but no runnable exploit. The EPSS score is approximately 0.041%, reflecting low current exploitation probability. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible Flowise instances (versions ≤ 3.0.13) using tools like Shodan or Censys, searching for the Flowise web UI or API endpoints.
2. Obtain a credentialId: Enumerate or obtain a valid credentialId from the Flowise instance — this may be leaked via a separate vulnerability, exposed API response, or guessed if IDs follow a predictable pattern.
3. Craft the malicious request: Send an unauthenticated HTTP POST request to /api/v1/text-to-speech/generate with the target credentialId in the request body and no chatflowId field:

POST /api/v1/text-to-speech/generate HTTP/1.1
Host: <target>
Content-Type: application/json

{"credentialId": "<victim-credential-id>", "text": "test", "provider": "openai", "voice": "alloy", "model": "tts-1"}

4. Trigger credential decryption: The endpoint decrypts the stored API key associated with the provided credentialId and uses it to call the third-party TTS service, consuming the victim's API credits.
5. Abuse at scale: Repeat requests with arbitrary text payloads to exhaust the victim's API quota or credits on OpenAI, ElevenLabs, or other configured providers (GitHub Advisory).

• Network: Unusual or high-volume unauthenticated POST requests to /api/v1/text-to-speech/generate from unexpected source IPs; outbound TTS API calls to OpenAI, ElevenLabs, Azure, or Google TTS services not correlated with legitimate user activity.
• Logs: Flowise access logs showing repeated requests to /api/v1/text-to-speech/generate without authentication headers or session tokens; SSE tts_start events triggered without a corresponding chatflowId in the request.
• Third-Party API Dashboards: Unexpected spikes in API usage or credit consumption on OpenAI, ElevenLabs, Azure Cognitive Services, or Google Cloud TTS accounts linked to Flowise credentials; API calls originating from the Flowise server IP at unusual times or volumes (GitHub Advisory).

Upgrade Flowise to version 3.1.0 or later, which removes the TTS endpoint from the unauthenticated whitelist and enforces credential ownership validation. For organizations unable to patch immediately, restrict network-level access to the /api/v1/text-to-speech/generate endpoint via firewall rules or a reverse proxy requiring authentication. As a precautionary measure, rotate any API credentials (OpenAI, ElevenLabs, Azure, Google) stored in Flowise, and monitor third-party API dashboards for anomalous usage. The suggested code fix is to return HTTP 401 when no chatflowId is provided, preventing unauthenticated credential use (GitHub Advisory).

The vulnerability was credited to Shinobi Security (GitHub: shinobisecurity) and published by igor-magun-wd via GitHub's security advisory program on April 15, 2026. A brief mention appeared on Mastodon via @thehackerwire on April 24, 2026. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).