Unauthorized Access in Flowise Drag & Drop Interface for Text-to-Speech Generation

CVE-2026-41279

What is CVE-2026-41279?

The Flowise drag-and-drop interface, designed for creating customized large language model workflows, has a notable vulnerability in its text-to-speech generation endpoint. Versions prior to 3.1.0 allow unauthenticated access to POST /api/v1/text-to-speech/generate, enabling attackers to submit a credentialId directly within the request body. Without requiring a chatflowId, this endpoint can be exploited to decrypt sensitive stored credentials, such as API keys from OpenAI or ElevenLabs, facilitating unauthorized access to these resources. This issue has been addressed in version 3.1.0, so users are advised to upgrade to this version to ensure the security of their applications.

References