GHSA-x5w6-38gp-mrqh CVE-2026-41275
Flowise: Password Reset Link Sent Over Unsecured HTTP
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.18%
- Chance of exploitation in the next 30 days. Higher than 7.13% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-319 Cleartext Transmission of Sensitive Information
- Fix
3.1.0- Upgrade flowise to this version or later
Description
Summary: The password reset functionality on cloud.flowiseai.com sends a reset password link over the unsecured HTTP protocol instead of HTTPS. This behavior introduces the risk of a man-in-the-middle (MITM) attack, where an attacker on the same network as the user (e.g., public Wi-Fi) can intercept the reset link and gain unauthorized access to the victim’s account.
Steps to Reproduce:
- Sign up for a new account on https://cloud.flowiseai.com/register.
- Navigate to the https://cloud.flowiseai.com/forgot-password page and enter your email.
- Open your inbox and locate the password reset email.
- Copy the reset link and inspect its protocol – it uses http:// instead of https://.
Impact: If a victim receives this insecure link and uses it over an untrusted network, an attacker can sniff the traffic and capture the reset token. This allows the attacker to hijack the victim's password reset session, potentially compromising their account.
Mitigation: Ensure all sensitive URLs, especially password reset links, are generated and transmitted over secure https:// endpoints only.
Best Practice: Use HTTPS in all password-related email links. Implement HSTS (HTTP Strict Transport Security) to enforce secure connections.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| flowise | < 3.1.0 |
3.1.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
flowise npm → 3.1.0
- npm
npm install flowise@3.1.0- yarn
yarn add flowise@3.1.0- pnpm
pnpm add flowise@3.1.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- Active
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
How to prevent it
- Architecture and Design: Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
- Implementation: When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
- Implementation: When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
- Testing: Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
- Operation: Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-w7x8-q2gp-5cgg Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass | Critical | Also affects flowise |
| GHSA-9gvv-qjj3-2p6g Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium | High | Also affects flowise |
| GHSA-qgvm-j2hm-6m38 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service | Critical | Also affects flowise |
| GHSA-5xvg-pmgg-3mxr Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | Critical | Also affects flowise |
| GHSA-gmmw-qg98-6j6p Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation | High | Also affects flowise |
| GHSA-8gj2-2cvc-6xx7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials | Medium | Also affects flowise |
| GHSA-fm2f-4339-4p2f Flowise: Missing Authorization on Execution Update Endpoint | Medium | Also affects flowise |
| GHSA-wch5-xp77-fxg4 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak | High | Also affects flowise |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor