CVE-2026-70471 Overview
CVE-2026-70471 is an authorization bypass vulnerability in Flowise, a drag-and-drop interface for building large language model (LLM) flows. Versions prior to 3.1.3 inject $vars into the code execution sandbox without enforcing the variables:view permission. A user or API key lacking that permission can call /api/v1/node-custom-function and receive $vars pre-populated with all workspace variables. The exposed data includes static values and runtime variables resolved from process.env. Attackers can extract secrets such as database passwords, JWT signing keys, SMTP credentials, and cloud provider keys. The issue is tracked as [CWE-863: Incorrect Authorization] and is fixed in Flowise 3.1.3.
Critical Impact
Authenticated users with restricted permissions can exfiltrate all workspace secrets, including cloud keys and database credentials, by invoking the custom function endpoint.
Affected Products
- Flowise (FlowiseAI) versions prior to 3.1.3
- Flowise deployments using the Variables API for secret management
- Self-hosted and cloud-hosted Flowise workspaces with multi-user access
Discovery Timeline
- 2026-08-04 - CVE-2026-70471 published to NVD
- 2026-08-04 - Last updated in NVD database
- Flowise 3.1.3 - FlowiseAI releases patched version resolving the authorization bypass
Technical Details for CVE-2026-70471
Vulnerability Analysis
The vulnerability stems from inconsistent permission enforcement across two code paths that access the same variable store. The official variables route enforces the variables:view permission. However, the code execution sandbox path bypasses this check entirely. When a request reaches /api/v1/node-custom-function, the server fetches all workspace variables and injects them into the sandbox context as $vars. The caller receives the fully populated object regardless of their role or API key scope.
The exposed structure maps Variable.name to Variable.value for static variables. Runtime variables map Variable.name to process.env[Variable.name], resolving server-side environment values back to the caller. Because Flowise workspaces commonly store integration secrets as variables, this endpoint effectively becomes an unrestricted secret retrieval API for any authenticated principal.
Root Cause
The root cause is a missing authorization check in the variable resolution path implemented in packages/components/src/utils.ts. Variable fetching occurs during node execution setup without validating whether the invoking identity holds variables:view. The permission model was applied only at the REST route layer, not at the underlying data access layer.
Attack Vector
An attacker with any authenticated session or API key, including a role that explicitly denies variables:view, sends a POST request to /api/v1/node-custom-function with custom function code that reads $vars. The response body or execution output returns the workspace variable dictionary. No exploitation code has been published, and the attack requires low privileges but does not require user interaction. See the GitHub Security Advisory GHSA-8r8h-6vcc-xhrv for the vendor's technical description.
Detection Methods for CVE-2026-70471
Indicators of Compromise
- Unexpected POST requests to /api/v1/node-custom-function from user accounts or API keys that lack variables:view permission
- Custom function payloads that reference the $vars object, Object.keys($vars), or serialize $vars to strings
- Outbound traffic or log entries containing values matching known workspace secrets after custom function execution
- Successful /api/v1/node-custom-function invocations followed by authentication failures against external services using rotated credentials
Detection Strategies
- Audit Flowise application logs for /api/v1/node-custom-function calls correlated with the caller's role and permission set
- Baseline expected custom function usage per workspace and alert on invocations from non-developer roles
- Inspect custom function source code stored server-side for references to $vars iteration or reflection patterns
- Compare access frequency of the custom function endpoint against the official /variables route for anomalies
Monitoring Recommendations
- Forward Flowise HTTP access logs and application logs to a centralized SIEM for correlation with identity events
- Monitor for use of workspace secrets outside of expected node executions, such as SMTP credentials appearing in outbound HTTP requests
- Track process environment variable read patterns on the Flowise host to identify unusual runtime variable resolution volume
How to Mitigate CVE-2026-70471
Immediate Actions Required
- Upgrade all Flowise instances to version 3.1.3 or later without delay
- Rotate every secret stored in Flowise workspace Variables, including database passwords, JWT secrets, SMTP passwords, and cloud provider keys
- Review audit logs for prior invocations of /api/v1/node-custom-function by principals lacking variables:view and treat matching workspaces as potentially compromised
- Restrict API key issuance and revoke keys granted to low-trust integrations until the upgrade is verified
Patch Information
FlowiseAI addressed the vulnerability in Flowise 3.1.3 by enforcing the variables:view permission before $vars is injected into the code execution sandbox. Download the release from GitHub Flowise Release 3.1.3 and follow the standard upgrade procedure for your deployment model.
Workarounds
- Disable the custom function node for workspaces that do not require it until patching is complete
- Remove sensitive values from workspace Variables and move them to an external secrets manager referenced only by trusted server-side code
- Restrict Flowise access to a narrow set of trusted developer accounts using network controls or reverse-proxy authentication
- Audit and tighten role assignments so that only intended users hold the ability to invoke node execution endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
