CVE-2026-70478: 
Flowise vulnerability analysis and mitigation

CVE-2026-70478 is a missing authentication vulnerability in Flowise, a drag-and-drop UI for building customized LLM flows, affecting all versions up to and including 3.1.2. The flaw allows unauthenticated attackers to call the OAuth2 token refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) and receive valid OAuth2 access tokens in the response, enabling unauthorized access to any connected third-party service. The advisory was first published on July 29, 2026, and added to the GitHub Advisory Database on August 4, 2026. It carries a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Flowise Security Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is explicitly listed in WHITELIST_URLS (defined in packages/server/src/utils/constants.ts, line 40), bypassing all authentication middleware. When called, the server decrypts the stored credential — which contains clientId, clientSecret, and refresh_token — sends a refresh request to the configured OAuth provider, and returns the new access_token directly in the JSON response body via the tokenInfo object (see packages/server/src/routes/oauth2/index.ts, lines 393–402). An attacker only needs a valid credentialId, which can be obtained through enumeration or via a separate public chatflow information leak. No authentication, privileges, or user interaction are required (GitHub Advisory, Flowise Security Advisory).

Successful exploitation allows an attacker to steal valid OAuth2 access tokens for any third-party service connected to the Flowise instance, including Google, Microsoft, and GitHub accounts, granting full access to those services without the victim's knowledge. The client secret is also transmitted to the OAuth provider during the refresh process, potentially exposing it to interception. Additionally, repeated calls to the endpoint can exhaust the victim's OAuth refresh token quota, resulting in a denial-of-service condition for legitimate users of the connected services (GitHub Advisory, Flowise Security Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and minimal technical skill — only a credential ID is needed — making it highly automatable and trivially exploitable against any internet-exposed Flowise instance running a vulnerable version (GitHub Advisory). The vulnerability was discovered and reported by Shinobi Security (GitHub: shinobisecurity) and credited to DeathsPirate (Flowise Security Advisory).

1. Reconnaissance: Identify internet-facing Flowise instances (versions ≤ 3.1.2) using tools like Shodan or Censys, searching for the Flowise web UI or API endpoints.
2. Obtain a credential ID: Acquire a valid credentialId through enumeration (e.g., brute-forcing UUIDs), or by exploiting a separate information disclosure vulnerability such as a public chatflow leak that exposes credential IDs.
3. Call the unauthenticated endpoint: Send an unauthenticated HTTP POST request to the target:

   POST /api/v1/oauth2-credential/refresh/<credentialId>
   Host: <target-flowise-instance>

   No Authorization header or session cookie is required.
4. Extract the access token: Parse the JSON response body, which contains the tokenInfo.access_token field with a valid, freshly issued OAuth2 access token.
5. Access connected services: Use the stolen access token to authenticate against the victim's connected third-party service (e.g., Google APIs, Microsoft Graph, GitHub API) and perform unauthorized actions.
6. Optional — DoS via token exhaustion: Repeatedly call the endpoint to exhaust the OAuth provider's refresh token quota, locking the legitimate user out of their connected service (GitHub Advisory, Flowise Security Advisory).

• Network: Repeated unauthenticated HTTP POST requests to /api/v1/oauth2-credential/refresh/<uuid> from external or unexpected IP addresses; absence of Authorization headers in requests to this endpoint.
• Logs: Web server/application logs showing POST /api/v1/oauth2-credential/refresh/ requests returning HTTP 200 responses without a corresponding authenticated session; multiple requests with different or sequentially enumerated credential IDs (UUID patterns) from the same source IP.
• OAuth Provider Logs: Unexpected token refresh events in connected OAuth provider audit logs (e.g., Google Workspace, Microsoft Entra ID, GitHub) originating from the Flowise server IP at unusual times or frequencies.
• Application Behavior: Sudden exhaustion of OAuth refresh token quota for connected services; legitimate users receiving authentication errors from connected third-party services despite valid credentials (GitHub Advisory).

FlowiseAI has released version 3.1.3, which fixes this vulnerability by removing the OAuth2 token refresh endpoint from WHITELIST_URLS and requiring authentication for all credential-related operations. All users running Flowise ≤ 3.1.2 should upgrade to 3.1.3 immediately. As a temporary workaround prior to upgrading, administrators can restrict network access to the Flowise API (e.g., via firewall rules or reverse proxy authentication) to prevent unauthenticated external access to the /api/v1/oauth2-credential/refresh/ endpoint (GitHub Advisory, Flowise Security Advisory).

The vulnerability was noted on Mastodon/infosec.exchange by the offseq security account shortly after disclosure. Tenable added a cloud security plugin (ID 445667) for detection. No major vendor statements or widespread media coverage have been identified beyond the GitHub advisory and standard vulnerability aggregator coverage (Feedly).