CVE-2026-70636: Flowise auth bypass triggers

CISO Take

Flowise's authentication middleware whitelists routes by prefix match instead of exact match, so an unauthenticated attacker can append a trailing credential identifier to the whitelisted oauth2-credential path and reach the token refresh endpoint without ever logging in — notably, this is the second bypass of the same control, since it defeats the fix shipped for CVE-2026-41273. The practical damage is forced, unauthorized rotation of OAuth2 credentials belonging to any workspace on the instance, which can silently break every downstream integration relying on those tokens rather than expose the credentials themselves (CVSS 3.1 vector shows C:N/I:H/A:N). Exploitation pressure is currently low — EPSS sits at 0.37% (69th percentile), the CVE is not in CISA KEV, there is no public PoC or Nuclei template, and CISA's own SSVC decision is TRACK — but the bug requires zero privileges, zero user interaction, and a single crafted POST request, so that can flip fast once weaponized. No patched version is listed, and the vendor's own advisory link points to a Flowise sunset notice, so treat this as unlikely to receive a hotfix: enforce authentication on `/api/v1/oauth2-credential/*` at the reverse proxy/WAF, monitor for unexpected credential-refresh events, and factor the vendor's uncertain roadmap into any migration planning.

Sources: NVD EPSS ATLAS CISA SSVC vulncheck.com flowiseai.com

What is the risk?

CVSS 7.5 (High) with a network vector, no privileges required, and no user interaction places this in the 'easy to exploit if discovered' bucket typical of authorization bypass bugs. Actual exploitation likelihood today is low (EPSS 0.37%, 69th percentile; no KEV listing; no public exploit code or Nuclei template; SSVC TRACK), but the underlying flaw is trivial once understood — a prefix-matching whitelist that can be defeated by appending a trailing path segment — and the fact that it bypasses a prior fix (CVE-2026-41273) signals a recurring pattern in how this middleware handles route authorization. With 158 other CVEs recorded against the Flowise package and a package risk score of 0/100, this instance sits in an already high-vulnerability-density codebase, which raises the odds of adjacent, undiscovered auth issues in the same file.

How does the attack unfold?

Discovery

Attacker identifies an internet-exposed Flowise instance and locates the oauth2-credential refresh route.

AML.T0006

Exploitation

Attacker sends an unauthenticated POST request with a trailing credential identifier appended to the whitelisted path, defeating the prefix-based auth middleware.

AML.T0049

Impact

The request triggers unauthorized OAuth2 token rotation for a target workspace's credentials, disrupting dependent AI agent integrations without the attacker's knowledge or the victim's action.

AML.T0029

Discovery

Attacker identifies an internet-exposed Flowise instance and locates the oauth2-credential refresh route.

AML.T0006

Exploitation

Attacker sends an unauthenticated POST request with a trailing credential identifier appended to the whitelisted path, defeating the prefix-based auth middleware.

AML.T0049

Impact

The request triggers unauthorized OAuth2 token rotation for a target workspace's credentials, disrupting dependent AI agent integrations without the attacker's knowledge or the victim's action.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I High

A None

What should I do?

1 step

No patched version is listed in this advisory and the vendor advisory link references a Flowise sunset page, so do not wait on an upstream fix. Immediate actions: (1) block or require authentication for /api/v1/oauth2-credential/* routes at the reverse proxy/API gateway/WAF layer, independent of the app's own middleware; (2) audit exposure — confirm whether the Flowise instance is reachable from the public internet and restrict to VPN/allowlisted IPs if not required; (3) rotate all stored OAuth2 credentials proactively and re-validate downstream integrations; (4) monitor logs/SIEM for POST requests to oauth2-credential refresh routes with anomalous trailing path segments or unauthenticated origin; (5) given the vendor sunset signal, evaluate migration off Flowise for business-critical agent workflows rather than treating this as a one-off patch-and-move-on issue.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Agent Plugin AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2.2 - AI system security

NIST AI RMF

MANAGE 4 - Risk treatments, including response and recovery, are documented and monitored

Frequently Asked Questions

What is CVE-2026-70636?

Flowise's authentication middleware whitelists routes by prefix match instead of exact match, so an unauthenticated attacker can append a trailing credential identifier to the whitelisted oauth2-credential path and reach the token refresh endpoint without ever logging in — notably, this is the second bypass of the same control, since it defeats the fix shipped for CVE-2026-41273. The practical damage is forced, unauthorized rotation of OAuth2 credentials belonging to any workspace on the instance, which can silently break every downstream integration relying on those tokens rather than expose the credentials themselves (CVSS 3.1 vector shows C:N/I:H/A:N). Exploitation pressure is currently low — EPSS sits at 0.37% (69th percentile), the CVE is not in CISA KEV, there is no public PoC or Nuclei template, and CISA's own SSVC decision is TRACK — but the bug requires zero privileges, zero user interaction, and a single crafted POST request, so that can flip fast once weaponized. No patched version is listed, and the vendor's own advisory link points to a Flowise sunset notice, so treat this as unlikely to receive a hotfix: enforce authentication on `/api/v1/oauth2-credential/*` at the reverse proxy/WAF, monitor for unexpected credential-refresh events, and factor the vendor's uncertain roadmap into any migration planning.

Is CVE-2026-70636 actively exploited?

No confirmed active exploitation of CVE-2026-70636 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-70636?

No patched version is listed in this advisory and the vendor advisory link references a Flowise sunset page, so do not wait on an upstream fix. Immediate actions: (1) block or require authentication for `/api/v1/oauth2-credential/*` routes at the reverse proxy/API gateway/WAF layer, independent of the app's own middleware; (2) audit exposure — confirm whether the Flowise instance is reachable from the public internet and restrict to VPN/allowlisted IPs if not required; (3) rotate all stored OAuth2 credentials proactively and re-validate downstream integrations; (4) monitor logs/SIEM for POST requests to oauth2-credential refresh routes with anomalous trailing path segments or unauthenticated origin; (5) given the vendor sunset signal, evaluate migration off Flowise for business-critical agent workflows rather than treating this as a one-off patch-and-move-on issue.

What systems are affected by CVE-2026-70636?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration platforms, third-party tool/API integrations.

What is the CVSS score for CVE-2026-70636?

CVE-2026-70636 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.49%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration platformsthird-party tool/API integrations

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2.2

NIST AI RMF: MANAGE 4

What are the technical details?

Original Advisory

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation against credentials belonging to any workspace and potentially disrupting dependent OAuth integrations. This is a bypass of CVE-2026-41273.

Exploitation Scenario

An attacker scans for internet-exposed Flowise instances (common via Shodan/Censys or GitHub-hosted deployment guides) and identifies the target's `/api/v1/oauth2-credential` refresh route. Rather than the base whitelisted path, the attacker appends a trailing credential identifier (e.g., `/oauth2-credential/refresh/<id>`), which the prefix-based whitelist check in the authentication middleware still matches as 'allowed', letting the request through with no session, API key, or workspace membership. The attacker then repeatedly triggers OAuth2 token rotation for credentials belonging to workspaces they have no access to, invalidating the tokens used by that workspace's AI agent integrations and disrupting or silently breaking dependent automations until an admin notices and manually re-authenticates the connectors.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.