Quick answers
- Is CVE-2026-41275 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41275 being exploited in the wild.
- How severe is CVE-2026-41275?
- High severity, with a CVSS score of 7.5, published 23 April 2026.
- Which products and versions are affected?
- flowise (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0.
- Is there a fix for CVE-2026-41275?
- Yes. flowise (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-41275 attacked?
- It is attacked over the network or from the adjacent network.
- Am I affected by CVE-2026-41275?
- Check whether you run FlowiseAI Flowise or flowise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- flowise (npm): upgrade to 3.1.0 or later
npm install flowise@3.1.0
Technical details
The vulnerability is a failure to use HTTPS for sensitive password reset URLs (CWE-319). The root cause is that cloud.flowiseai.com generates password reset email links using HTTP protocol instead of HTTPS. An attacker positioned on the same network as the victim (e.g., via ARP spoofing or DNS hijacking on public Wi-Fi) can perform a man-in-the-middle attack to intercept the plaintext reset link and extract the reset token. The attack requires the attacker to be on the same network and the user to click the insecure link, but no prior authentication or privileges are needed. Exploitation allows complete account takeover. The vulnerability is fixed in version 3.1.0; all versions prior to 3.0.13 are affected.
Affected products
- FlowiseAI Flowise <=3.0.13
Identifiers
- CVE-2026-41275
- GHSA-x5w6-38gp-mrqh
Timeline
- 2026-04-16: disclosed
- 2026-04-16: patched: Fix available in version 3.1.0