CVE-2026-71962: Flowise Auth Bypass Vulnerability

CVE-2026-71962 Overview

CVE-2026-71962 is a missing authorization vulnerability [CWE-862] in Flowise, an open-source low-code platform for building large language model (LLM) applications. The flaw affects Flowise versions 2.2.4 through 3.1.4 and resides in the POST /api/v1/openai-assistants-file/download endpoint. The endpoint is incorrectly included in the global authentication whitelist, which bypasses all session and API key verification. Unauthenticated attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations.

Critical Impact
Remote, unauthenticated attackers can exfiltrate private files across tenant boundaries on any exposed Flowise instance running an affected version.

Affected Products

Flowise 2.2.4 through 3.1.4
Deployments exposing the /api/v1/openai-assistants-file/download endpoint to untrusted networks
Multi-tenant Flowise instances hosting chatflows for multiple workspaces or organizations

Discovery Timeline

2026-08-10 - CVE-2026-71962 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71962

Vulnerability Analysis

The vulnerability stems from an authorization gap in Flowise's HTTP routing layer. The application maintains a global authentication whitelist that exempts specific endpoints from session and API key enforcement. The POST /api/v1/openai-assistants-file/download route was added to that whitelist, which removes every authentication and authorization check applied to other file access endpoints.

Because the handler still accepts caller-supplied identifiers, an attacker who knows or guesses valid chatflowId, chatId, and fileName values can request any file the server has stored for OpenAI Assistants integrations. The server returns the file contents in the response body without verifying workspace ownership, tenant membership, or API key possession.

The impact is confidentiality-focused. Files uploaded by tenants for use with OpenAI Assistants, including proprietary documents, training data, and customer records, become retrievable by any network attacker who can reach the endpoint.

Root Cause

The root cause is a broken access control configuration [CWE-862]. Placing the download endpoint on the authentication whitelist removed the middleware that would normally enforce session validity, API key checks, and tenant scoping. The handler itself does not re-validate the caller's authorization against the requested chatflowId.

Attack Vector

The attack is executed over the network with no privileges and no user interaction. An attacker sends a crafted POST request to /api/v1/openai-assistants-file/download containing JSON with chatflowId, chatId, and fileName values. Valid identifiers can be obtained through information leaks, brute forcing UUID patterns in specific deployments, or prior access to any single tenant.

See the VulnCheck Advisory on Flowise and the GitHub Gist Security Research writeup for technical details on the request structure and reproduction steps.

Detection Methods for CVE-2026-71962

Indicators of Compromise

Unauthenticated POST requests to /api/v1/openai-assistants-file/download in web server or reverse proxy logs
Requests to the download endpoint from source IPs that never authenticated to /api/v1/auth or presented an API key in the same session
Bursts of download requests iterating over multiple chatflowId or fileName values from a single source
Successful 200 OK responses to the endpoint originating from external networks

Detection Strategies

Alert on any HTTP request to /api/v1/openai-assistants-file/download where no prior authenticated session exists for the client IP or user agent
Correlate outbound file transfers from the Flowise host with inbound requests to the vulnerable endpoint to identify data exfiltration
Baseline normal request volume to the endpoint and flag deviations that suggest enumeration

Monitoring Recommendations

Forward Flowise access logs and reverse proxy logs to a centralized analytics platform for query and retention
Monitor process and file system telemetry on Flowise hosts for unusual reads of files under the OpenAI Assistants storage directory
Track egress bandwidth from Flowise pods or containers to detect bulk file exfiltration

How to Mitigate CVE-2026-71962

Immediate Actions Required

Restrict network access to Flowise administrative and API endpoints using firewall rules, VPN gating, or reverse proxy allowlists
Block or filter requests to /api/v1/openai-assistants-file/download at the reverse proxy until a fixed version is deployed
Audit stored OpenAI Assistants files and identifiers to assess whether sensitive material warrants rotation or notification
Review the Flowise AI Sunset Announcement to plan migration, as continued maintenance of the affected product line is limited

Patch Information

At the time of publication, no vendor-supplied fixed version is listed in the NVD entry for CVE-2026-71962. Operators should consult the VulnCheck Advisory on Flowise for the latest guidance on upgrades or hotfixes and monitor the Flowise project for post-sunset security releases.

Workarounds

Remove the openai-assistants-file/download route from the global authentication whitelist in the deployed source and rebuild the application
Place Flowise behind an authenticating reverse proxy that requires a valid session cookie or API key on all /api/v1/ paths
Disable the OpenAI Assistants integration if it is not in use to eliminate the attack surface

bash

# Example NGINX reverse proxy rule blocking the vulnerable endpoint
location = /api/v1/openai-assistants-file/download {
    deny all;
    return 403;
}