CVE-2026-70478 FlowiseAI CVE debrief

Who should care

Flowise users and administrators, security teams, and organizations using Flowise for large language model flows should be aware of this critical vulnerability and take immediate action to protect their systems. They should review the official CVE record and assess their exposure. Security teams should prioritize patching or mitigating this vulnerability to prevent unauthorized access and potential quota exhaustion. Additionally, they should monitor for suspicious activity on the OAuth2 credential refresh endpoint and implement additional authentication and authorization mechanisms to prevent exploitation. IT and development teams responsible for maintaining Flowise deployments should coordinate with security teams to ensure prompt remediation and verify the effectiveness of implemented controls. Compliance and risk management teams should also be informed of this vulnerability and its potential impact on the organization's security posture and regulatory compliance. End-users of Flowise should be aware of the potential risks and communicate with their administrators to ensure proper mitigation and remediation efforts are undertaken. Managed security service providers and incident response teams should be prepared to assist with detection, response, and remediation efforts related to this vulnerability. Lastly, researchers and threat intelligence teams should monitor for potential exploits and emerging threat actor activities related to this vulnerability. The CVE-2026-70478 issue exists in Flowise, a drag & drop user interface for building customized large language model flows. The vulnerability affects the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is included in WHITELIST_URLS and requires no authentication. This endpoint decrypts stored credentials, sends refresh requests to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. The issue is fixed in version 3.1.3. To verify and mitigate this vulnerability, defenders should

Technical summary

The Flowise application, prior to version 3.1.3, contains a critical vulnerability in its OAuth2 credential refresh endpoint. The endpoint, which is included in WHITELIST_URLS, requires no authentication and allows an attacker with a credential ID to access the victim's connected service and potentially exhaust refresh-token quota. The vulnerability is addressed in version 3.1.3. To defend against this vulnerability, security teams should review and update Flowise to version 3.1.3 or later, restrict access to the affected endpoint, monitor for suspicious activity on the OAuth2 credential refresh endpoint, and implement additional authentication and authorization mechanisms.

Defensive priority

Critical vulnerability in Flowise's OAuth2 credential refresh endpoint allows unauthorized access and potential quota exhaustion.

Recommended defensive actions

• Review and update Flowise to version 3.1.3 or later
• Restrict access to the affected endpoint
• Monitor for suspicious activity on the OAuth2 credential refresh endpoint
• Implement additional authentication and authorization mechanisms
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-70478 issue exists in Flowise, a drag & drop user interface for building customized large language model flows. The vulnerability affects the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is included in WHITELIST_URLS and requires no authentication. This endpoint decrypts stored credentials, sends refresh requests to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. The issue is fixed in version 3.1.3.

Official resources