CVE-2026-70636 FlowiseAI CVE debrief

Who should care

Organizations using Flowise, especially those with OAuth integrations, should be aware of this vulnerability and take steps to verify their instances and apply remediation. Security teams and vulnerability management teams should prioritize this vulnerability due to its potential impact on OAuth integrations and dependent systems. Operators of Flowise deployments should review their configurations and ensure that compensating controls are in place to monitor for suspicious activity.

Technical summary

CVE-2026-70636 is an authentication bypass vulnerability in Flowise versions up to 3.1.4. The vulnerability allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware. This can lead to unauthorized OAuth token rotation against credentials belonging to any workspace, potentially disrupting dependent OAuth integrations and impacting security teams. Affected organizations should prioritize verifying their instances for exposure and applying vendor remediation to prevent unauthorized OAuth token rotation.

Defensive priority

Organizations using Flowise should prioritize verifying their instances for exposure and applying vendor remediation to prevent unauthorized OAuth token rotation.

Recommended defensive actions

• Verify Flowise instance exposure and apply vendor remediation
• Implement compensating controls to monitor OAuth token rotation
• Conduct inventory checks for Flowise deployments
• Review OAuth integrations for potential exposure
• Monitor for suspicious token rotation activity
• Assign an owner for follow-up on affected deployments
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE-2026-70636 record indicates Flowise versions up to 3.1.4 contain an authentication bypass vulnerability. Limited information is available on affected scope and vendor remediation efforts. Organizations should verify their instances, review OAuth integrations, and monitor for suspicious token rotation activity. Defensive measures include verifying instance exposure, implementing compensating controls, and conducting inventory checks for Flowise deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.