AI Threat Alert
CVE-2026-70478: Flowise: unauth OAuth refresh endpoint leaks access tokens
GHSA-qgvm-j2hm-6m38 CRITICAL CISA: TRACK*Flowise's credential refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) was mistakenly whitelisted to skip authentication, so anyone who knows or guesses a credential ID can trigger the server to decrypt the stored OAuth secret, refresh it against the provider, and hand back a live access_token in the HTTP response. This matters because Flowise is a low-code agent-building platform where OAuth credentials routinely connect agents to Gmail, Slack, Google Drive, and other high-value SaaS accounts — a stolen token means direct access to whatever service that credential was scoped to, with zero authentication required to trigger the leak. The vulnerability is rated critical and is trivial to exploit (no auth, no special tooling), though EPSS places it in the top 69th percentile (0.38%) with no public exploit, PoC, or Nuclei template yet, and it is not in CISA KEV — CISA's own SSVC decision is TRACK_STAR (monitor, not emergency). Repeated calls to the same endpoint can also exhaust the victim's OAuth refresh-token quota with the upstream provider, a secondary denial-of-service risk. Patch to Flowise 3.1.3 immediately, and if you can't patch now, block or require authentication on that route at your reverse proxy and rotate any OAuth credentials configured in affected instances.
What is the risk?
High practical risk despite the absence of a public exploit: the bar to exploitation is trivial (no authentication, no exotic payload — just a valid credential ID and a POST request), and the impact is a full OAuth access token handed directly to the attacker. Exposure is confined to self-hosted Flowise instances reachable by an attacker (internet-facing or reachable from a compromised internal host) that have OAuth credentials configured for connected tools. Likelihood of opportunistic scanning is elevated given Flowise's popularity as an agent-building platform and the fact that 158 other CVEs already exist in this package, signaling a large, actively-probed attack surface even though EPSS scoring for this specific CVE is moderate.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Flowise | npm | <= 3.1.2 | 3.1.3 |
Do you use Flowise? You're affected.
How severe is it?
What should I do?
1 step-
1) Upgrade to Flowise 3.1.3 or later immediately — this removes the endpoint from WHITELIST_URLS and enforces authentication. 2) If immediate upgrade isn't possible, block external/unauthenticated access to /api/v1/oauth2-credential/refresh/:credentialId at the reverse proxy or WAF as a stopgap. 3) Rotate all OAuth credentials (client secrets and refresh tokens) stored in any internet-reachable Flowise instance, since past exposure cannot be ruled out. 4) Review OAuth provider audit logs for unexpected refresh/token-grant activity tied to Flowise-issued credentials. 5) Restrict Flowise instances to internal networks or behind authentication (VPN/SSO) as defense in depth, since credential-scoped endpoints like this one are a recurring risk class in agent-builder platforms.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-70478?
Flowise's credential refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) was mistakenly whitelisted to skip authentication, so anyone who knows or guesses a credential ID can trigger the server to decrypt the stored OAuth secret, refresh it against the provider, and hand back a live access_token in the HTTP response. This matters because Flowise is a low-code agent-building platform where OAuth credentials routinely connect agents to Gmail, Slack, Google Drive, and other high-value SaaS accounts — a stolen token means direct access to whatever service that credential was scoped to, with zero authentication required to trigger the leak. The vulnerability is rated critical and is trivial to exploit (no auth, no special tooling), though EPSS places it in the top 69th percentile (0.38%) with no public exploit, PoC, or Nuclei template yet, and it is not in CISA KEV — CISA's own SSVC decision is TRACK_STAR (monitor, not emergency). Repeated calls to the same endpoint can also exhaust the victim's OAuth refresh-token quota with the upstream provider, a secondary denial-of-service risk. Patch to Flowise 3.1.3 immediately, and if you can't patch now, block or require authentication on that route at your reverse proxy and rotate any OAuth credentials configured in affected instances.
Is CVE-2026-70478 actively exploited?
No confirmed active exploitation of CVE-2026-70478 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-70478?
1) Upgrade to Flowise 3.1.3 or later immediately — this removes the endpoint from WHITELIST_URLS and enforces authentication. 2) If immediate upgrade isn't possible, block external/unauthenticated access to /api/v1/oauth2-credential/refresh/:credentialId at the reverse proxy or WAF as a stopgap. 3) Rotate all OAuth credentials (client secrets and refresh tokens) stored in any internet-reachable Flowise instance, since past exposure cannot be ruled out. 4) Review OAuth provider audit logs for unexpected refresh/token-grant activity tied to Flowise-issued credentials. 5) Restrict Flowise instances to internal networks or behind authentication (VPN/SSO) as defense in depth, since credential-scoped endpoints like this one are a recurring risk class in agent-builder platforms.
What systems are affected by CVE-2026-70478?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI orchestration, OAuth-integrated agent tools.
What is the CVSS score for CVE-2026-70478?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0034 Cost Harvesting AML.T0055 Unsecured Credentials AML.T0083 Credentials from AI Agent Configuration AML.T0091.000 Application Access Token Compliance Controls Affected
What are the technical details?
Original Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. This issue is fixed in 3.1.3.
Exploitation Scenario
An attacker discovers or is given network access to a self-hosted Flowise instance (e.g., via a misconfigured internet-facing deployment or lateral movement inside a corporate network). Flowise credential IDs are exposed or can be enumerated/observed from the UI, API responses, or prior reconnaissance. The attacker sends an unauthenticated POST to /api/v1/oauth2-credential/refresh/{credentialId}; Flowise decrypts the stored OAuth client secret and refresh token, calls the OAuth provider to mint a fresh access_token, and returns it in the HTTP response body. The attacker now holds a valid access token scoped to whatever service the credential connects to (e.g., Gmail, Slack, Drive) and uses it directly against that provider's API to read data, exfiltrate files, or send messages as the victim — entirely outside of Flowise's own logging. Alternately, the attacker repeatedly hits the endpoint to burn through the OAuth provider's refresh-token issuance quota, disrupting the legitimate integration.
Weaknesses (CWE)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Primary
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Primary
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2025-71338 10.0 Flowise: unauthenticated file write enables RCE
Same package: flowise CVE-2025-59528 10.0 Flowise: Unauthenticated RCE via MCP config injection
Same package: flowise CVE-2026-46442 9.9 Flowise: sandbox escape enables authenticated RCE
Same package: flowise CVE-2025-61913 9.9 Flowise: path traversal in file tools leads to RCE
Same package: flowise CVE-2026-40933 9.9 Flowise: RCE via MCP stdio command injection
Same package: flowise