CVE-2026-71962

Executive Summary

CVE-2026-71962 is a missing authorization vulnerability (CWE-862) affecting Flowise versions 2.2.4 through 3.1.4, specifically in the POST /api/v1/openai-assistants-file/download endpoint. This flaw allows unauthenticated attackers to access private files by exploiting the endpoint's erroneous inclusion in the global authentication whitelist, completely bypassing all session and API key verification mechanisms. The vulnerability carries a CVSS score of 7.5 (High) and has no known patch available by any tracked source, leaving all affected deployments exposed. Organizations running Flowise instances are at risk of confidential data exfiltration, including files belonging to private chatflows across different workspaces or organizations.

Technical Analysis

The vulnerability resides in Flowise versions 2.2.4 through 3.1.4, specifically within the file download endpoint exposed at POST /api/v1/openai-assistants-file/download. The root cause stems from the endpoint being incorrectly placed in the global authentication whitelist, a mechanism designed to exclude certain routes from authentication checks. Because of this misconfiguration, requests reaching this endpoint are never subject to session validation or API key verification, regardless of whether the requesting entity is authenticated.

From a code-level perspective, Flowise's authentication middleware typically iterates through a list of whitelisted API paths that are exempt from auth requirements, commonly intended for endpoints that host public resources such as static assets or public chat widgets. The administrative misconfiguration likely involved the addition of this download endpoint to that whitelist during a routine update, perhaps to address a legitimate UX concern. Unfortunately, because the endpoint serves user-controlled file content, this whitelist misconfiguration immediately transforms a protected resource into a public one.

The exploit path requires three identifiers to be supplied: chatflowId, chatId, and fileName. Each parameter references internal resources within the Flowise ecosystem. The chatflowId identifies a specific chatflow deployment — a conversational workflow graph. The chatId references a particular session instance of that chatflow. The fileName references the specific file to be downloaded. None of these identifiers are cryptographically random or designed to be unguessable; they are typically monotonically increasing integers or UUIDs stored in the application database, making enumeration feasible.

The critical security implication is that the endpoint does not verify whether the requesting party has legitimate access to the named chatflow. Even if a chatflow is marked private and belongs to a separate workspace or organization within a multi-tenant Flowise deployment, the download endpoint will happily retrieve files associated with it, provided valid identifiers are supplied. This constitutes an horizontal and vertical privilege escalation combined: horizontal because any unauthenticated user can access any other user's files, and vertical because no authentication is required at all.

The NVD description explicitly notes that this allows attackers to "retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations." This confirms that the authorization check is entirely absent at the application layer — the missing verification is not merely weak but completely nonexistent.

Exploitation Scenarios

No public PoC or exploit code is currently available for CVE-2026-71962, as of the intelligence reporting date. The attack chain described below is inferred from the vulnerability class (missing authorization) and the endpoint specification provided in the NVD description. Specific implementation details beyond those given should not be assumed.

Step 1 — Reconnaissance and Target Identification: An attacker begins by identifying exposed Flowise instances. Flowise typically runs on port 3000 by default, and its login page or API documentation (/api/v1) is often publicly accessible. Network scanning using Shodan or similar services with banners such as Flowise or specific HTTP responses can quickly identify instances. The attacker then confirms the affected version range (2.2.4 through 3.1.4) — if the instance does not immediately expose a version identifier, the attacker may fingerprint it via API response headers, error message structures, or by probing known route patterns.

Step 2 — Identifier Enumeration: Once a target instance is confirmed, the attacker must obtain valid chatflowId and chatId values. Flowise often exposes chatflowId values in the application's URL routing. For instance, public chat widgets embed a chatflow ID in their script. An attacker can enumerate these by: (1) fetching the public-facing chatbot widget or its embedded configuration, (2) querying the Flowise API's discovery endpoints if any are unauthenticated, or (3) leveraging IDOR-like enumeration by incrementing numeric identifiers and observing differing HTTP responses. The chatId may be obtainable through similar means — sometimes these are returned in chat session responses, or they can be generated by initiating a chat session with an existing chatflow.

Step 3 — Payload / Request Construction: The attacker constructs a POST request to the vulnerable endpoint:

POST /api/v1/openai-assistants-file/download

with a body containing the three identifiers: chatflowId, chatId, fileName. No authentication headers, session cookies, or API keys are sent — the request is sent completely unauthenticated. The fileName can be enumerated or guessed based on common file naming conventions used in the Flowise environment (e.g., uploaded documents, PDFs, text files).

Step 4 — Post-Exploitation Impact: Successful requests return the file contents in the HTTP response body. The attacker can now download any file associated with any chatflow on the instance. This enables systematic data harvesting: by iterating through chatflowId values and trying multiple fileName values (e.g., starting with common names like document.pdf, notes.txt, data.csv), the attacker can exfiltrate documents, spreadsheets, source code snippets, and any other file that users have uploaded into their chatflows. In multi-tenant deployments, this crosses organizational boundaries, exposing one tenant's data to another. The confidentiality impact is rated High per the CVSS vector.

Impact Assessment

The confidentiality impact is rated High per the CVSS 3.1 vector (C:H), while integrity and availability remain unchanged (I:N, A:N). The attack has a low complexity (AC:L) and can be executed remotely without any privileges (PR:N) and without user interaction (UI:N), via the network vector (AV:N). These factors combine to produce the overall CVSS score of 7.5 (High).

From a business perspective, the impact is substantial for any organization running Flowise as a conversational AI platform — particularly those handling internal documents, intellectual property, or PII within chatflows. Data exfiltration could violate regulatory obligations (GDPR, HIPAA, industry-specific rules), resulting in financial penalties and reputational damage. In multi-tenant SaaS deployments built on Flowise, the blast radius extends beyond the single tenant: an attacker targeting the platform can exfiltrate data belonging to all customers, creating a supply-chain style compromise scenario. Even in single-tenant internal deployments, the exposure of proprietary documents, credentials, or business plans is critical.

The attacker does not need prior access, valid credentials, or any special knowledge beyond identifying an exposed instance. The lack of any authentication requirement amplifies the threat — this is not a privilege escalation that requires an authenticated session; it is a fully unauthenticated data-access vulnerability.

Detection Guidance

Sigma Rule

title: Unauthenticated File Download via Flowise OpenAI Assistants Endpoint
id: 7f7c39d2-5a3b-4e61-b2a8-3f0c9d7a4e55
status: experimental
description: Detects unauthenticated POST requests to the Flowise openai-assistants-file download endpoint, indicating potential exploitation of CVE-2026-71962.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-71962
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: nginx
    service: http
detection:
    selection:
        cs-method: POST
        cs-uri-path: /api/v1/openai-assistants-file/download
    filter_normal:
        cs-username: exists
    condition: selection and not filter_normal
level: high
falsepositives:
    - Internal automation scripts that have been erroneously whitelisted
    - Legitimate unauthenticated download usage in misconfigured deployments

YARA Rule

rule Flowise_Unauth_File_Download_CVE_2026_71962 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP requests targeting the vulnerable Flowise endpoint"
        date = "2026-01-15"
        reference = "CVE-2026-71962"
        severity = "high"
    strings:
        $path = "/api/v1/openai-assistants-file/download" ascii wide
        $chatflow_param = "chatflowId" ascii wide
        $chat_param = "chatId" ascii wide
        $file_param = "fileName" ascii wide
    condition:
        $path and 2 of ($chatflow_param, $chat_param, $file_param)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-71962 - Flowise Unauthenticated File Download Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/openai-assistants-file/download"; nocase; http.request_body; content:"chatflowId"; nocase; content:"chatId"; nocase; content:"fileName"; nocase; classtype:attempted-recon; sid:202671962; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15;)

Elastic Detection

For Elastic Endpoint EQL:

network where process.name == "chrome" or process.name == "*curl*" // adjust based on your telemetry
  and http.request.method == "POST"
  and url.path == "/api/v1/openai-assistants-file/download"
  and not http.request.headers.authorization != null

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path="/api/v1/openai-assistants-file/download"
| eval has_auth=if(isnull(authorization),"NO","YES")
| search has_auth="NO"
| table _time, src_ip, uri_path, user, host, status
| sort + _time

Wazuh OSSEC Rule

<group name="flowise,web,attack,">
    <rule id="176690" level="12">
        <if_sid>31100</if_sid>
        <match>/api/v1/openai-assistants-file/download</match>
        <regex>POST</regex>
        <description>Potential CVE-2026-71962 exploitation - unauthenticated file download request to Flowise endpoint</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>flowise_exploit_attempt,</group>
    </rule>
</group>

Mitigation & Patch Guidance

PATCH CONFIDENCE: 0/4 — UNPATCHED. No patch evidence from any tracked source exists as of this report. The vendor, Thomas Eichmann (maintainer of Flowise), has not released a fixed version, and the NVD entry lists no vendor fix or workarounds. The affected version list is empty in the advisory data, though the description confirms 2.2.4 through 3.1.4 are vulnerable.

Immediate Mitigations (until a patch is released):

1. Block/restrict the endpoint: Deploy a web application firewall (WAF) or reverse-proxy rule that returns HTTP 403 for any request matching POST /api/v1/openai-assistants-file/download unless it originates from a known, authenticated, trusted IP range.
2. Network segmentation: Place the Flowise instance behind a VPN or corporate network boundary, ensuring it is not accessible from the public internet. This directly eliminates the network attack vector (AV:N becomes AV:A).
3. API gateway authentication: If using an API gateway or middleware in front of Flowise, enforce mandatory authentication at the gateway level for this specific path, overriding the application-level whitelist behavior.
4. Monitor and log: Enable verbose request logging for the endpoint and integrate detection rules from the Detection Guidance section above; alert on any unauthenticated hits.

Patch/Upgrade Steps:

1. Monitor the Flowise GitHub repository and release feed for a patched version exceeding 3.1.4.
2. When available, upgrade immediately to the fixed version, prioritizing out-of-band (non-production) validation first.
3. There is no @flowiseai/flowise npm package version with a confirmed fix at this time; re-check npm view flowise versions or the GitHub releases page for the vendor's announcement.

Long-Term Hardening:

1. Implement mandatory authentication for all /api/v1/ endpoints as a policy; conduct a periodic audit of any whitelisted paths in the application's security configuration to prevent similar misconfigurations.
2. Enforce multi-tenancy isolation at the data layer — ensure that even if an endpoint lacks authorization, the underlying data store access is blocked by row-level security or namespace scoping.
3. Conduct routine security code reviews focusing on authorization logic, particularly for file upload/download features.
4. Enable CISA KEV monitoring and subscribe to Flowise release notifications.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-71962 — Official CVE description from NVD.
2. Flowise Official GitHub Repository: https://github.com/FlowiseAI/Flowise — Monitor for patch announcements and release notes.
3. Flowise Documentation: https://docs.flowiseai.com — Official documentation on API authentication and whitelisting configuration.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-71962 is not currently listed; re-check periodically for updates.
5. EPSS / FIRST: https://www.first.org/epss/ — Provides the EPSS score reference (0.00448), indicating low current exploitation probability, but confidence in exploitation is increasing (36.9th percentile).

Threat Actor Evidence: No known threat actor campaigns have been publicly attributed to CVE-2026-71962 at the time of writing. The EPSS score (0.00448) and the 36.9th percentile suggest low immediate exploitation in the wild, though the lack of a patch may prompt scanning campaigns in the future. No exploit code or PoC is publicly available (POC_STATUS: None).