User Interface Vulnerability in Flowise by FlowiseAI

CVE-2026-70471

What is CVE-2026-70471?

Flowise, a tool for creating customized large language model flows, had a security flaw that allowed unauthorized access to sensitive variables in the application. Before version 3.1.3, the application injected $vars into the code execution environment without enforcing appropriate permissions through the Variables API. As a result, users or API keys that should not have access could still invoke the /api/v1/node-custom-function endpoint and gain access to all workspace variables, potentially leaking sensitive information like database credentials, JWT secrets, and other critical environment variables. This issue has been addressed in version 3.1.3, emphasizing the importance of updating to the latest version for enhanced security.

References