AI Threat AlertCVE-2026-71962: Flowise: auth bypass leaks private chatflow files
HIGHPoC AVAILABLECISA: TRACK*Flowise, versions 2.2.4 through 3.1.4, mistakenly placed the POST /api/v1/openai-assistants-file/download endpoint on its global authentication whitelist, so anyone who can reach the instance over the network can retrieve files from any chatflow simply by supplying a valid chatflowId, chatId, and fileName — no session or API key required. This matters because Flowise chatflows commonly store OpenAI Assistants files that include RAG source documents, uploaded customer data, or internal knowledge bases, meaning a single misconfigured endpoint exposes cross-workspace and cross-organization confidentiality with zero privileges and zero user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). There is no public exploit or scanner template yet and EPSS sits low (0.45%, top 63rd percentile), and CISA's SSVC decision is TRACK_STAR rather than an active-exploitation call, so this is not yet a KEV-grade emergency — but the trivial exploitability and file-confidentiality impact still warrant prompt remediation. Upgrade past 3.1.4 immediately; until patched, front the instance with a reverse proxy or WAF that enforces authentication on this endpoint and restrict network exposure to trusted networks, while monitoring access logs for unauthenticated or bulk requests to /api/v1/openai-assistants-file/download.
What is the risk?
High confidentiality-only impact (CVSS 3.1: 7.5, C:H/I:N/A:N) with network attack vector, low complexity, no privileges, and no user interaction — an ideal profile for opportunistic scanning once the vulnerability class becomes known. Exploitability is currently constrained by the need for valid-looking chatflowId/chatId/fileName tuples, which raises the bar slightly above a purely trivial bypass but is still well within reach via enumeration, log leakage, or URL sharing between users. No CISA KEV listing, no public PoC, and a low EPSS score indicate exploitation is not yet observed in the wild, but the missing-authorization root cause (CWE-862) is a class of bug that is easy to weaponize once discovered by mass scanners, so the risk profile should be treated as elevated rather than low.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Flowise | npm | — | No patch |
Do you use Flowise? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 stepUpgrade Flowise to a version beyond 3.1.4 that removes this endpoint from the global authentication whitelist or enforces proper authorization checks. If immediate patching is not possible, deploy a reverse proxy or WAF rule that requires authentication before requests reach /api/v1/openai-assistants-file/download, and restrict network access to the Flowise instance (VPN, IP allowlist, or private network) rather than exposing it directly to the internet. For detection, audit access logs for POST requests to this endpoint originating from unauthenticated sessions, unfamiliar IPs, or sequential/enumerated chatflowId and fileName values, and review whether any files were downloaded by unrecognized clients since version 2.2.4 was deployed.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-71962?
Flowise, versions 2.2.4 through 3.1.4, mistakenly placed the POST /api/v1/openai-assistants-file/download endpoint on its global authentication whitelist, so anyone who can reach the instance over the network can retrieve files from any chatflow simply by supplying a valid chatflowId, chatId, and fileName — no session or API key required. This matters because Flowise chatflows commonly store OpenAI Assistants files that include RAG source documents, uploaded customer data, or internal knowledge bases, meaning a single misconfigured endpoint exposes cross-workspace and cross-organization confidentiality with zero privileges and zero user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). There is no public exploit or scanner template yet and EPSS sits low (0.45%, top 63rd percentile), and CISA's SSVC decision is TRACK_STAR rather than an active-exploitation call, so this is not yet a KEV-grade emergency — but the trivial exploitability and file-confidentiality impact still warrant prompt remediation. Upgrade past 3.1.4 immediately; until patched, front the instance with a reverse proxy or WAF that enforces authentication on this endpoint and restrict network exposure to trusted networks, while monitoring access logs for unauthenticated or bulk requests to /api/v1/openai-assistants-file/download.
Is CVE-2026-71962 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-71962, increasing the risk of exploitation.
How to fix CVE-2026-71962?
Upgrade Flowise to a version beyond 3.1.4 that removes this endpoint from the global authentication whitelist or enforces proper authorization checks. If immediate patching is not possible, deploy a reverse proxy or WAF rule that requires authentication before requests reach /api/v1/openai-assistants-file/download, and restrict network access to the Flowise instance (VPN, IP allowlist, or private network) rather than exposing it directly to the internet. For detection, audit access logs for POST requests to this endpoint originating from unauthenticated sessions, unfamiliar IPs, or sequential/enumerated chatflowId and fileName values, and review whether any files were downloaded by unrecognized clients since version 2.2.4 was deployed.
What systems are affected by CVE-2026-71962?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, low-code AI orchestration.
What is the CVSS score for CVE-2026-71962?
CVE-2026-71962 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.68%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0025Exfiltration via Cyber MeansAML.T0035AI Artifact CollectionAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations.
Exploitation Scenario
An attacker discovers an internet-facing Flowise instance (via Shodan-style fingerprinting of the product) and, without authenticating, sends a POST request to /api/v1/openai-assistants-file/download with a chatflowId, chatId, and fileName obtained through enumeration, leaked shared links, or prior reconnaissance of the target's chatflow naming patterns. Because the endpoint is exempted from Flowise's global auth checks, the request succeeds regardless of the attacker's lack of credentials, and the server returns the requested file — potentially a RAG knowledge base document, a customer upload, or another workspace's private artifact — allowing the attacker to iterate over guessed or harvested identifiers to harvest files across multiple chatflows and tenants on the same instance.
Weaknesses (CWE)
CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2025-7133810.0Flowise: unauthenticated file write enables RCE
Same package: flowiseCVE-2025-5952810.0Flowise: Unauthenticated RCE via MCP config injection
Same package: flowiseCVE-2025-619139.9Flowise: path traversal in file tools leads to RCE
Same package: flowiseCVE-2026-409339.9Flowise: RCE via MCP stdio command injection
Same package: flowiseCVE-2026-464429.9Flowise: sandbox escape enables authenticated RCE
Same package: flowise