CVE-2026-70636

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Missing Authorization pada flowiseai flowise. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation against credentials belonging to any workspace and potentially disrupting dependent OAuth integrations. This is a bypass of CVE-2026-41273.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

15 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-70636.md exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/flowise-authentication-bypass-via-oauth2-credential-refresh-endpoint advisory pihak ketiga
• https://flowiseai.com/sunset not applicable