CVE-2026-41275: Flowise Information Disclosure Flaw

CVE-2026-41275 Overview

Flowise is a drag & drop user interface to build customized large language model (LLM) flows. A security vulnerability was discovered in the password reset functionality on cloud.flowiseai.com where reset password links are transmitted over the unsecured HTTP protocol instead of HTTPS. This cleartext transmission of sensitive credentials creates a significant risk for man-in-the-middle (MITM) attacks, particularly when users are connected to shared or public networks such as public Wi-Fi hotspots.

Critical Impact

Attackers positioned on the same network as victims can intercept password reset links and gain unauthorized access to user accounts, potentially compromising sensitive LLM workflow configurations and data.

Affected Products

• Flowise versions prior to 3.1.0
• cloud.flowiseai.com password reset functionality
• FlowiseAI cloud-hosted services

Discovery Timeline

• 2026-04-23 - CVE CVE-2026-41275 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-41275

Vulnerability Analysis

This vulnerability is classified under CWE-319 (Cleartext Transmission of Sensitive Information). The core issue stems from the password reset mechanism transmitting authentication-sensitive URLs over unencrypted HTTP connections rather than secure HTTPS. When a user initiates a password reset on cloud.flowiseai.com, the system generates a unique reset token embedded within a URL that is sent to the user's registered email address. However, the link within this email directs users to an HTTP endpoint, meaning the reset token and associated session data traverse the network in plaintext.

The attack complexity is elevated as it requires the attacker to be positioned on the same network segment as the victim. This scenario is most likely in environments such as coffee shops, airports, hotels, or other locations offering public Wi-Fi access. An attacker utilizing network sniffing tools can passively capture HTTP traffic and extract the password reset URL, subsequently using it to reset the victim's password before the legitimate user can act.

Root Cause

The root cause of this vulnerability is the improper configuration of the password reset email template and associated backend logic, which generates HTTP URLs instead of enforcing HTTPS for all authentication-related communications. This represents a failure to implement transport layer security for sensitive credential recovery operations. The system lacks proper URL scheme enforcement that would ensure all security-critical links utilize encrypted communication channels.

Attack Vector

The attack vector is network-based and requires the following conditions for successful exploitation:

An attacker must establish a position on the same network as the target user, typically through connecting to the same public Wi-Fi network. Using packet capture tools such as Wireshark or tcpdump, the attacker can monitor all unencrypted HTTP traffic flowing through the network. When the victim initiates a password reset request and clicks the HTTP link in their email, the attacker can observe the complete reset URL including the authentication token. The attacker can then race to use this captured token to complete the password reset process before the legitimate user, effectively hijacking account access.

The vulnerability requires user interaction as the victim must initiate and click through the password reset flow. For detailed technical analysis, refer to the GitHub Security Advisory and the HackerOne Report #1888915.

Detection Methods for CVE-2026-41275

Indicators of Compromise

• Password reset requests followed by successful authentication from IP addresses different from the user's typical geographic location
• Multiple password reset completions for the same account within a short time window
• Login attempts from known public network IP ranges immediately following password reset token generation
• Anomalous account activity patterns following password reset operations

Detection Strategies

• Implement network traffic analysis to identify HTTP-based password reset link transmissions
• Monitor authentication logs for account takeover patterns associated with MITM attacks
• Deploy intrusion detection rules to flag cleartext transmission of sensitive URL parameters containing reset tokens
• Configure SentinelOne Singularity platform to detect and alert on suspicious authentication behavior following password reset events

Monitoring Recommendations

• Enable comprehensive logging of all password reset requests including source IP, timestamp, and completion status
• Implement user behavior analytics to detect anomalous login patterns post-password reset
• Monitor for rapid succession of password reset requests targeting multiple accounts from similar network segments
• Configure alerts for password reset link clicks originating from unexpected network locations

How to Mitigate CVE-2026-41275

Immediate Actions Required

• Upgrade Flowise to version 3.1.0 or later immediately
• Audit recent password reset activity for signs of account compromise
• Force password resets for any accounts that may have been compromised via this vulnerability
• Educate users about the risks of initiating password resets while connected to public networks

Patch Information

The vulnerability has been addressed in Flowise version 3.1.0. Organizations running self-hosted Flowise instances should update to this version immediately. Users of cloud.flowiseai.com should verify that the service has been patched by confirming password reset links now use HTTPS. For additional details, consult the GitHub Security Advisory.

Workarounds

• Avoid initiating password reset requests while connected to public or untrusted Wi-Fi networks
• Use a VPN connection when performing any authentication-related operations on public networks
• Configure network-level HTTPS enforcement using a corporate proxy or firewall for all connections to flowiseai.com domains
• Implement additional multi-factor authentication controls to limit the impact of potential account compromise

# Configuration example - Enforce HTTPS redirect at reverse proxy level (nginx example)
server {
    listen 80;
    server_name cloud.flowiseai.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name cloud.flowiseai.com;
    # SSL configuration continues...
}