CVE-2026-70473: Flowise broken authz leaks Qdrant

Q: Is CVE-2026-70473 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-70473, increasing the risk of exploitation.

Q: How to fix CVE-2026-70473?

Upgrade to Flowise 3.1.3 or later, which fixes the missing authorization check per the vendor advisory (GHSA-fr6g-7cq8-fg82). Until patched, restrict access to /api/v1/upsert-history (and ideally the whole admin/API surface) to trusted networks via firewall/reverse-proxy rules, and disable public internet exposure of self-hosted Flowise instances where possible. After patching, rotate credentials and review access controls on any Vector Store (e.g., Qdrant) endpoints that may have been disclosed via this endpoint. For detection, review Flowise access logs and any WAF/proxy logs for unauthenticated or cross-tenant GET requests to /api/v1/upsert-history, and monitor for anomalous connection attempts against the exposed vector database URLs.

Q: What systems are affected by CVE-2026-70473?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, agent frameworks, vector databases, multi-tenant SaaS deployments.

Q: What is the CVSS score for CVE-2026-70473?

No CVSS score has been assigned yet.

CISO Take

A missing authorization check on Flowise's GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history to any requester, with no scoping to user, tenant, or workspace — responses can exceed 100MB and include Vector Store connection details such as Qdrant server URLs and collection names. There's no CVSS score or CISA KEV listing, and CISA's SSVC decision is the lower-priority TRACK_STAR, but a working PoC already exists and EPSS places it in the top 84% of CVEs by predicted exploitation likelihood, so opportunistic scanning is realistic. Because Flowise deployments are often multi-tenant drag-and-drop RAG/agent builders, this is a workspace isolation failure, not just an info leak: infrastructure fingerprinting from the exposed Qdrant URL/collection name can feed follow-on attacks against the vector database itself. Patch to Flowise 3.1.3 immediately; if you can't patch right away, restrict network access to /api/v1/upsert-history at the reverse proxy/firewall layer and audit any internet-facing Flowise instances for unauthenticated access. Review logs for unusual GET requests to this endpoint and rotate any Qdrant/vector-store credentials or URLs that may already have been exposed.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

No CVSS score is published, but the underlying weakness (CWE-862 Missing Authorization, compounded by CWE-200/CWE-202 sensitive data exposure) is straightforward to exploit — a single unauthenticated GET request — and a public PoC exists, which typically accelerates opportunistic scanning even without a formal severity score. EPSS at the 84th percentile signals meaningfully elevated exploitation probability relative to the broader CVE population. CISA's SSVC 'Track*' decision indicates it doesn't meet the bar for urgent/immediate action, and it is not in CISA KEV, so there is no evidence of active exploitation yet. The realistic risk is reconnaissance and lateral targeting (infrastructure/config disclosure) rather than direct RCE or data destruction, but exposure of internal vector-store endpoints materially lowers the cost of a follow-on attack against the RAG backend.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated GET request to /api/v1/upsert-history on an internet-facing Flowise instance.

AML.T0049

Data Exposure

Server returns the entire server-wide upsert history (>100MB), unscoped by tenant, including Vector Store configuration.

AML.T0084

Target Identification

Attacker extracts the exposed Qdrant server URL and collection name to identify the RAG backend for further targeting.

AML.T0064

Impact

Attacker probes or attacks the identified vector database directly, risking exfiltration or poisoning of RAG-indexed data.

AML.T0075

Initial Access

Attacker sends an unauthenticated GET request to /api/v1/upsert-history on an internet-facing Flowise instance.

AML.T0049

Data Exposure

Server returns the entire server-wide upsert history (>100MB), unscoped by tenant, including Vector Store configuration.

AML.T0084

Target Identification

Attacker extracts the exposed Qdrant server URL and collection name to identify the RAG backend for further targeting.

AML.T0064

Impact

Attacker probes or attacks the identified vector database directly, risking exfiltration or poisoning of RAG-indexed data.

AML.T0075

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade to Flowise 3.1.3 or later, which fixes the missing authorization check per the vendor advisory (GHSA-fr6g-7cq8-fg82). Until patched, restrict access to /api/v1/upsert-history (and ideally the whole admin/API surface) to trusted networks via firewall/reverse-proxy rules, and disable public internet exposure of self-hosted Flowise instances where possible. After patching, rotate credentials and review access controls on any Vector Store (e.g., Qdrant) endpoints that may have been disclosed via this endpoint. For detection, review Flowise access logs and any WAF/proxy logs for unauthenticated or cross-tenant GET requests to /api/v1/upsert-history, and monitor for anomalous connection attempts against the exposed vector database URLs.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Framework Agent RAG AML.T0049 - Exploit Public-Facing Application AML.T0064 - Gather RAG-Indexed Targets AML.T0075 - Cloud Service Discovery AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.8 - AI system life cycle - security controls

NIST AI RMF

MAP 5.1 - Impacts to individuals, groups, and ecosystems are examined

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-70473?

A missing authorization check on Flowise's GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history to any requester, with no scoping to user, tenant, or workspace — responses can exceed 100MB and include Vector Store connection details such as Qdrant server URLs and collection names. There's no CVSS score or CISA KEV listing, and CISA's SSVC decision is the lower-priority TRACK_STAR, but a working PoC already exists and EPSS places it in the top 84% of CVEs by predicted exploitation likelihood, so opportunistic scanning is realistic. Because Flowise deployments are often multi-tenant drag-and-drop RAG/agent builders, this is a workspace isolation failure, not just an info leak: infrastructure fingerprinting from the exposed Qdrant URL/collection name can feed follow-on attacks against the vector database itself. Patch to Flowise 3.1.3 immediately; if you can't patch right away, restrict network access to /api/v1/upsert-history at the reverse proxy/firewall layer and audit any internet-facing Flowise instances for unauthenticated access. Review logs for unusual GET requests to this endpoint and rotate any Qdrant/vector-store credentials or URLs that may already have been exposed.

Is CVE-2026-70473 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-70473, increasing the risk of exploitation.

How to fix CVE-2026-70473?

Upgrade to Flowise 3.1.3 or later, which fixes the missing authorization check per the vendor advisory (GHSA-fr6g-7cq8-fg82). Until patched, restrict access to /api/v1/upsert-history (and ideally the whole admin/API surface) to trusted networks via firewall/reverse-proxy rules, and disable public internet exposure of self-hosted Flowise instances where possible. After patching, rotate credentials and review access controls on any Vector Store (e.g., Qdrant) endpoints that may have been disclosed via this endpoint. For detection, review Flowise access logs and any WAF/proxy logs for unauthenticated or cross-tenant GET requests to /api/v1/upsert-history, and monitor for anomalous connection attempts against the exposed vector database URLs.

What systems are affected by CVE-2026-70473?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, agent frameworks, vector databases, multi-tenant SaaS deployments.

What is the CVSS score for CVE-2026-70473?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesagent frameworksvector databasesmulti-tenant SaaS deployments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0064 Gather RAG-Indexed Targets

AML.T0075 Cloud Service Discovery

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.8

NIST AI RMF: MAP 5.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.

Exploitation Scenario

An attacker discovers an internet-facing Flowise instance (e.g., via Shodan/Censys fingerprinting or from a target organization's own documentation) and sends an unauthenticated GET request to /api/v1/upsert-history. The server returns the full, unfiltered upsert history for every tenant/workspace on that instance, including the Qdrant server URL and collection name used for the organization's RAG pipeline. The attacker now has a validated target for a second-stage attack directly against the vector database — probing it for weak authentication, attempting data exfiltration of embedded proprietary documents, or poisoning the RAG index to manipulate downstream LLM responses — all without needing to compromise Flowise itself further.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-202 Exposure of Sensitive Information Through Data Queries Primary CWE-202 Exposure of Sensitive Information Through Data Queries Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-202 Exposure of Sensitive Information Through Data Queries CWE-862 Missing Authorization

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.