CVE-2026-56271: Flowise hardcoded JWT secrets

CISO Take

Flowise's enterprise authentication middleware ships with hardcoded default JWT secrets, audience, and issuer values that silently activate whenever an operator forgets to set the four corresponding environment variables, letting any network attacker forge valid tokens and impersonate any user, including administrators, with zero authentication or user interaction (CVSS 9.8). This is not a subtle logic flaw — the fallback secrets ('auth_token', 'refresh_token', 'AUDIENCE', 'ISSUER') are published in the public GitHub advisory and the source code itself, so exploitation requires no custom tooling and no exploit development skill, only knowledge that the target Flowise instance hasn't overridden the defaults. There is no EPSS score yet, it isn't in CISA KEV, and no public PoC or Nuclei template exists at the time of writing, but the triviality of the attack combined with Flowise's role as an AI agent orchestration platform (which typically holds LLM API keys, tool credentials, and workflow logic) means a compromised instance hands an attacker admin-level control over connected AI agents and their integrations. Treat any self-hosted Flowise deployment as compromised until verified: upgrade to 3.1.0+ and confirm JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER are explicitly set to strong, unique values in every environment, then rotate all sessions and audit admin activity logs for anomalous access predating the fix.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical, low-effort, high-impact. Attack complexity is low and requires no privileges or user interaction — an attacker only needs network access to a Flowise instance running with unset JWT environment variables. Because the fallback values are hardcoded strings disclosed in the public advisory and source repository, this is functionally equivalent to a default-credential vulnerability: reproducibility is trivial once an attacker identifies an unpatched, misconfigured instance. The absence of an EPSS score and KEV listing reflects the CVE's freshness (published 2026-07-12), not lower real-world risk — hardcoded-secret auth bypasses in widely deployed self-hosted tools are historically exploited quickly once disclosed. Flowise's own history of 117 other CVEs in the same package suggests a pattern of security debt in this codebase, raising the likelihood that additional latent issues compound this one.

How does the attack unfold?

Recon

Attacker identifies an internet-facing Flowise enterprise deployment that has not overridden the default JWT environment variables.

AML.T0049

Token Forgery

Attacker crafts a JWT signed with the publicly known hardcoded secrets and default audience/issuer, setting claims to impersonate an admin user.

AML.T0091.000

Authentication Bypass

The forged token is accepted by the passport middleware, granting the attacker a fully authenticated admin session with no valid credentials.

AML.T0012

Impact

Attacker exfiltrates embedded LLM/API credentials and workflow data, and can modify live agent flows to inject malicious behavior affecting downstream users.

Recon

Attacker identifies an internet-facing Flowise enterprise deployment that has not overridden the default JWT environment variables.

AML.T0049

Token Forgery

Attacker crafts a JWT signed with the publicly known hardcoded secrets and default audience/issuer, setting claims to impersonate an admin user.

AML.T0091.000

Authentication Bypass

The forged token is accepted by the passport middleware, granting the attacker a fully authenticated admin session with no valid credentials.

AML.T0012

Impact

Attacker exfiltrates embedded LLM/API credentials and workflow data, and can modify live agent flows to inject malicious behavior affecting downstream users.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Flowise to version 3.1.0 or later immediately. 2) Regardless of version, explicitly set JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER to strong, randomly generated, unique values in every deployment environment (dev, staging, prod) — never rely on framework defaults. 3) Rotate these secrets and force logout of all active sessions after remediation, since any tokens forged prior to the fix remain valid until the signing secret changes. 4) Audit authentication and admin-action logs for tokens with the known default issuer/audience values ('ISSUER'/'AUDIENCE') or for admin actions from unrecognized source IPs/sessions predating the patch. 5) As a compensating control, restrict network exposure of the Flowise enterprise admin API to trusted networks/VPN until patched. 6) Add a startup-time check or secrets-manager enforcement that fails closed (refuses to start) if these four environment variables are unset, rather than silently falling back to insecure defaults.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Privacy Violation Code Execution Agent Framework API AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.1 - Operational planning and control

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-56271?

Flowise's enterprise authentication middleware ships with hardcoded default JWT secrets, audience, and issuer values that silently activate whenever an operator forgets to set the four corresponding environment variables, letting any network attacker forge valid tokens and impersonate any user, including administrators, with zero authentication or user interaction (CVSS 9.8). This is not a subtle logic flaw — the fallback secrets ('auth_token', 'refresh_token', 'AUDIENCE', 'ISSUER') are published in the public GitHub advisory and the source code itself, so exploitation requires no custom tooling and no exploit development skill, only knowledge that the target Flowise instance hasn't overridden the defaults. There is no EPSS score yet, it isn't in CISA KEV, and no public PoC or Nuclei template exists at the time of writing, but the triviality of the attack combined with Flowise's role as an AI agent orchestration platform (which typically holds LLM API keys, tool credentials, and workflow logic) means a compromised instance hands an attacker admin-level control over connected AI agents and their integrations. Treat any self-hosted Flowise deployment as compromised until verified: upgrade to 3.1.0+ and confirm JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER are explicitly set to strong, unique values in every environment, then rotate all sessions and audit admin activity logs for anomalous access predating the fix.

Is CVE-2026-56271 actively exploited?

No confirmed active exploitation of CVE-2026-56271 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56271?

1) Upgrade Flowise to version 3.1.0 or later immediately. 2) Regardless of version, explicitly set JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER to strong, randomly generated, unique values in every deployment environment (dev, staging, prod) — never rely on framework defaults. 3) Rotate these secrets and force logout of all active sessions after remediation, since any tokens forged prior to the fix remain valid until the signing secret changes. 4) Audit authentication and admin-action logs for tokens with the known default issuer/audience values ('ISSUER'/'AUDIENCE') or for admin actions from unrecognized source IPs/sessions predating the patch. 5) As a compensating control, restrict network exposure of the Flowise enterprise admin API to trusted networks/VPN until patched. 6) Add a startup-time check or secrets-manager enforcement that fails closed (refuses to start) if these four environment variables are unset, rather than silently falling back to insecure defaults.

What systems are affected by CVE-2026-56271?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration platforms, multi-tenant SaaS/enterprise deployments, RAG pipelines.

What is the CVSS score for CVE-2026-56271?

CVE-2026-56271 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.66%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration platformsmulti-tenant SaaS/enterprise deploymentsRAG pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.1

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.

Exploitation Scenario

An attacker scans for internet-facing Flowise deployments (e.g., via Shodan/censys fingerprinting or targeted recon of known AI agent platform ports) and identifies a target running an enterprise-configured instance. Knowing from the public GHSA advisory that unconfigured deployments fall back to the hardcoded secrets 'auth_token'/'refresh_token' with audience/issuer 'AUDIENCE'/'ISSUER', the attacker crafts a JWT signed with these known values, setting the claims to represent an administrator account. The attacker submits this forged token to the Flowise API, which — having never set the corresponding environment variables — validates it as legitimate and grants full admin session access. From there the attacker browses all workflows, extracts embedded LLM API keys and database credentials, exfiltrates proprietary agent logic and RAG data sources, and optionally modifies live agent flows to inject malicious tool calls or backdoors that execute against future end users of the platform.