CVE-2026-70636

Executive Summary

CVE-2026-70636 is a high-severity authentication bypass vulnerability (CVSS 7.5) affecting Flowise, a popular open-source visual framework for building LLM (Large Language Model) applications. All versions up to and including 3.1.4 are vulnerable. The flaw resides in the authentication middleware (packages/server/src/utils/constants.ts) where a prefix-based whitelist matching logic incorrectly grants unauthenticated access to the OAuth2 credential refresh endpoint. An attacker can exploit this by sending a crafted POST request with a trailing credential identifier to the OAuth2 credential refresh route, completely bypassing authentication and authorization. This allows unauthorized OAuth token rotation on credentials belonging to any workspace in the Flowise instance. The vulnerability is a bypass of a previously identified issue, CVE-2026-41273, indicating that earlier mitigations were insufficient. The confidentiality impact is none, but the integrity impact is high, as successful exploitation can disrupt dependent OAuth integrations, potentially breaking automated workflows that rely on those credentials. The vulnerability is remotely exploitable with no authentication required, making it a significant risk for any internet-facing Flowise deployment.

Technical Analysis

The vulnerability resides in the authentication and authorization middleware of the Flowise server application, specifically within the logic defined in packages/server/src/utils/constants.ts. This file contains configuration constants and helper functions used by middleware to determine whether a request to a specific route should be subjected to authentication checks.

The core issue is the use of a prefix-based whitelist matching mechanism. The middleware maintains a list of URL path prefixes considered "public" or "whitelisted," meaning they do not require authentication. When an HTTP request arrives, the middleware checks if the requested path starts with any of the whitelisted prefixes. If a match is found, the request proceeds without authentication.

The flaw is that the OAuth2 credential refresh route is intended to be a protected endpoint. However, due to a misconfiguration or a logic error in the whitelist definition, there exists a public prefix that overlaps with the protected route. For instance, if a whitelisted prefix is /api/v1/public/oauth2-credential and the actual protected route is /api/v1/oauth2-credential/refresh, the prefix-based check might incorrectly match against a broader or differently cased variant, or the path traversal test is deficient.

Specifically, the vulnerability is triggered by appending a trailing credential identifier to the OAuth2 refresh request. The middleware performs a prefix check that fails to account for path segments properly. By sending a POST request to a URL crafted to exploit this confusion, such as /api/v1/oauth2-credential/refresh/legitimate-public-prefix, the middleware's prefix-based matcher incorrectly identifies the request as belonging to the public whitelist and allows it through. This allows an unauthenticated attacker to reach the OAuth2 credential refresh logic, which expects to be invoked only after authentication and authorization checks.

The OAuth2 refresh endpoint itself likely accepts a credential ID as a parameter and proceeds to perform a token refresh against the OAuth2 provider for that stored credential. Without the authentication gate, the attacker can supply arbitrary credential IDs (or enumerate them) and trigger token rotation on critical OAuth2 credentials used in the Flowise workspace, such as those for OpenAI, Google, or other LLM providers. This unauthorized token rotation can invalidate currently valid tokens, causing service disruptions for legitimate users and integrations that depend on these credentials.

The vulnerability class is CWE-862 (Missing Authorization). The attack vector is network-based, requires low attack complexity, and requires no privileges or user interaction. The impact is limited to integrity (high), meaning the primary consequence is disruption rather than direct data theft.

Exploitation Scenarios

1. Reconnaissance:

   • The attacker first identifies a publicly accessible Flowise instance. This can be done via Shodan using dorks like http.title:"Flowise" or http.component:"Flowise", which will surface instances exposed on the default port (3000) or other common ports.
   • The attacker confirms the Flowise version by accessing the application's UI or by checking predictable static resource paths, banner grabbing, or probing the package.json file if it's exposed.

2. Endpoint Discovery:

   • The attacker performs lightweight enumeration of API routes. While the full API is not public, common Flowise API routes are documented in public repositories and blog posts. The attacker identifies the OAuth2 credential refresh endpoint path, typically something like /api/v1/oauth2-credential/refresh.
   • The attacker also notes the existence of whitelisted public endpoints by triggering unauthenticated requests to known public features (e.g., GET /api/v1/prediction, GET /api/v1/public-chatflows) and observing responses that do not return 401/403.

3. Trigger/Payload:

   • The attacker crafts a POST request to the OAuth2 refresh endpoint with an appended trailing identifier designed to fool the prefix-based whitelist matcher. The exact payload depends on the vulnerable logic, but the essential technique is to append a path segment that matches a whitelisted prefix pattern.
   • For example: POST /api/v1/oauth2-credential/refresh/public.ignore or POST /api/v1/oauth2-credential/refresh/%2e%2e/public (URL-encoded variants).
   • To identify a valid credential ID, the attacker may attempt to enumerate IDs (e.g., incremental integers), or may use credential IDs leaked via the application's database or from earlier exploitable information disclosure vulnerabilities.

4. Post-Exploitation Impact:

   • Upon successful request, the server executes the OAuth2 token refresh logic for the targeted credential, bypassing all authentication and authorization checks.
   • The refresh operation rotates the OAuth2 access and refresh tokens. This effectively revokes the current tokens. Any system, automation script, or chatflow in the Flowise instance that relies on those tokens will immediately lose access to the OAuth2-protected resource (e.g., an LLM API, a document store, a CRM system).
   • The attacker can repeat this for multiple credential IDs, causing a denial-of-service across the workspace. This disrupts business-critical integrations that depend on Flowise, which is often used as a central hub for LLM-powered applications.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N yields a base score of 7.5 (High). The primary impact is on integrity (I:H), with no impact on confidentiality (C:N) and no direct impact on availability (A:N). However, the availability of dependent systems is indirectly impacted because OAuth2 token rotation triggers outages in integrated services.

Business Impact:

• Service Disruption: Downtime for LLM-powered chat applications, automated workflows, and business processes that rely on OAuth2-connected tools.
• Supply Chain Risk: Flowise often serves as middleware connecting various AI services; a disruption here propagates to downstream applications.
• Trust Erosion: Security teams lose confidence in the platform, and incidents requiring manual token recovery will strain operational teams.
• Financial Loss: For organizations that monetize their LLM services, prolonged unavailability translates directly to lost revenue.

Blast Radius:

• Any Flowise instance exposed to the internet or untrusted networks.
• All OAuth2 credentials stored in the Flowise database across all workspaces (the vulnerability is not confined to a single workspace).
• Dependent OAuth integrations, including but not limited to OpenAI, Anthropic, Google Cloud, Azure OpenAI, Slack, and email providers.

CVSS Subscore Relevance:

• The PR:N (No Privileges Required) and AV:N (Network Attack Vector) reflect that this is trivially exploitable by anyone with network access to the application.
• The I:H subscore of 6.5 (per CVSS 3.1) corroborates the severe integrity impact on credential state.

Detection Guidance

Sigma Rule

title: Flowise OAuth2 Credential Refresh Authentication Bypass Attempt
id: 5f31a3b9-2c6f-4f1a-88e4-0a3d6de9292a
status: experimental
description: Detects POST requests to the Flowise OAuth2 credential refresh endpoint that attempt to bypass authentication via trailing path manipulation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-70636
author: Valtersit SOC
date: 2026/06/01
logsource:
    category: webserver
    product: apache
    definition: 'Flowise app behind reverse proxy'
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains:
            - 'oauth2-credential/refresh/' # trailing slash + extra segment
        cs-uri-query|endswith:
            - '/public'
            - '/ignore'
            - '/assets'
            - '/static'
    condition: selection
level: high
falsepositives:
    - Legitimate requests can occasionally have query parameters, but path modifications as specified are rare.
    - Internal maintenance scripts that intentionally use public prefixes.
fields:
    - clientip
    - cs-uri-query
    - cs-useragent

YARA Rule

rule Flowise_OAuth2_Auth_Bypass_CVE_2026_70636
{
    meta:
        author = "Valtersit Research"
        description = "Detects HTTP requests exploiting Flowise OAuth2 credential refresh authentication bypass"
        cve = "CVE-2026-70636"
        severity = "high"
    strings:
        $oauth2_refresh = "oauth2-credential/refresh" ascii wide nocase
        $public_prefix = "/public" ascii wide nocase
        $static_prefix = "/static" ascii wide nocase
        $post_method = "POST" ascii wide nocase
    condition:
        $post_method at 0 and
        $oauth2_refresh and
        ($public_prefix or $static_prefix)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Flowise OAuth2 Credential Refresh Authentication Bypass Attempt - CVE-2026-70636"; flow:to_server,established; content:"POST"; http_method; content:"oauth2-credential/refresh/"; http_uri; pcre:"/oauth2-credential\/refresh\/[a-zA-Z0-9_-]+(?:public|static|ignore)/Ui"; classtype:attempted-admin; reference:cve,2026-70636; sid:20260706; rev:1;)

Elastic Detection

// Elastic EQL query for Web Access Logs (logs-* or filebeat-*)
any where network.direction == "ingress" and
  http.request.method == "POST" and
  (
    url.path like "*oauth2-credential/refresh/*"
  ) and
  (
    url.path like "*/public" or
    url.path like "*/static" or
    url.path like "*/ignore"
  )

Splunk SPL Query

index=web sourcetype="access_combined" method=POST uri_path="*/oauth2-credential/refresh/*" 
| where uri_path IN ("*public", "*static", "*ignore") 
| stats count by clientip, uri_path, status 
| sort - count

Wazuh OSSEC Rule

<group name="flowise,">
  <rule id="100705" level="12">
    <decodedata>POST</decodedata>
    <field name="url">^/api/v1/oauth2-credential/refresh/.+</field>
    <field name="url" type="endswith">/public</field>
    <description>Flowise OAuth2 refresh auth bypass attempt (CVE-2026-70636)</description>
    <group>authentication_failure,attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source has been identified, and no fixed version of Flowise has been released to address this CVE. The following actions are recommended:

1. Immediate Mitigations:

   • Restrict Network Access: Implement a firewall or WAF rule to block external access to the /api/v1/oauth2-credential/* paths. Only allow requests to these endpoints from trusted internal IPs or VPN subnets.
   • Reverse Proxy Control: If using Nginx or Apache as a reverse proxy, add a location block to deny all requests containing oauth2-credential/refresh except from authenticated internal sources.
   • Disable OAuth2 Features: If OAuth2 credential refresh is not essential for your current workload, consider disabling the OAuth2 credential feature entirely in the Flowise configuration to reduce the attack surface.

2. Patch/Upgrade Steps (when available):

   • Monitor the Flowise GitHub repository (https://github.com/FlowiseAI/Flowise) and the official npm package for release announcements.
   • When a patched version is released (e.g., 3.1.5 or later), upgrade immediately: npm update -g flowise or by docker pull of the latest image.
   • Verify the patch addresses the prefix-based whitelist matching by reviewing the changelog for fixes to packages/server/src/utils/constants.ts.

3. Long-Term Hardening:

   • Run Flowise Behind a Reverse Proxy: Never expose the Flowise server port (default 3000) directly to the internet. Use a reverse proxy with proper path-based authentication rules.
   • Network Segmentation: Place Flowise in a private subnet with strict egress/ingress firewall rules.
   • Credential Hygiene: Store OAuth2 credentials with minimal scopes and rotate them regularly to limit the impact of a token rotation attack.
   • Security Audits: Regularly audit the Flowise configuration and review the constants.ts file for any similar prefix-matching flaws if you maintain a custom fork.
   • Intrusion Detection: Deploy the detection rules above to your SIEM/IDS infrastructure for early threat discovery.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-70636
• Flowise GitHub Repository: https://github.com/FlowiseAI/Flowise
• Flowise Official Documentation: https://docs.flowiseai.com/
• Related CVE (Bypassed Issue): CVE-2026-41273 (NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41273)
• CISA Known Exploited Vulnerabilities Catalog: The CISO KEV list currently indicates NO known exploitation in the wild for this CVE. No threat actor campaigns have been publicly attributed to CVE-2026-70636 at the time of writing.