Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
HighCVE-2026-70471 · Published Aug 4, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| flowise npm | < 3.1.3 | 3.1.3 |
Details and references
## Finding , Unauthorized Workspace Variables disclosure via $vars injection (bypasses variables:view) ### What’s wrong (code locations) - Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 - Runtime variables are resolved from server environment variables: flowise-src/packages/components/src/utils.ts:976 - $vars is always injected into the code execution sandbox: flowise-src/packages/components/src/utils.ts:1782 - The official Variables API is permission-protected (contrast): flowise-src/packages/server/src/routes/variables/ index.ts:11 ### Why it is a privilege boundary bypass A user/API key might be denied variables:view (and the /api/v1/variables route enforces it), but they can still: - call /api/v1/node-custom-function (Finding 1) - and have $vars pre-populated with all variables for the workspace, including runtime values from process.env ### What data is exposed Inside the custom JS context, $vars contains a flat map of: - Variable.name -> Variable.value for static variables, and - Variable.name -> process.env[Variable.name] for runtime variables (type === 'runtime') This can expose secrets such as database passwords, JWT secrets, SMTP passwords, cloud keys, etc., depending on what the workspace Variables are configured to map. ### Recommended fix (minimum) - Do not inject $vars unless the caller is authorized: - enforce variables:view before injecting $vars, or - inject only an explicit allowlist of variables needed for the function - Consider disabling or heavily restricting type=runtime variables in self-hosted environments (or restrict which env keys may be mapped).
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- CVE-2026-70471
More Flowise advisories
All Flowise| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 4 | Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint CVE-2026-73488Mediumfixed in 3.1.3 | Medium | 3.1.3 |
| Aug 4 | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration CVE-2026-69250Highfixed in 3.1.3 | High | 3.1.3 |
| Aug 4 | Flowise RCE via TypeORM DataSource CVE-2026-69251Criticalfixed in 3.1.3 | Critical | 3.1.3 |
| Aug 4 | Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization CVE-2026-69252Highfixed in 3.1.3 | High | 3.1.3 |
| Aug 4 | Flowise Sandbox Escape to RCE CVE-2026-69253Criticalfixed in 3.1.3 | Critical | 3.1.3 |
| Aug 4 | Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override CVE-2026-69254Criticalfixed in 3.1.3 | Critical | 3.1.3 |