Executive brief
Flowise, an open-source tool for building LLM applications, contains a security flaw that allows users with limited access to view sensitive workspace secrets. By using specific custom functions, an attacker can bypass intended permission restrictions to access database passwords, API keys, and other credentials stored in the environment. This could lead to unauthorized access to connected third-party services and sensitive corporate data.
Technical details
An authorization bypass exists in Flowise due to improper Role-Based Access Control (RBAC) enforcement when handling workspace variables. While the official Variables API (/api/v1/variables) correctly enforces the 'variables:view' permission, the custom function endpoint (/api/v1/node-custom-function) fetches and injects the full '$vars' object into the execution sandbox without verifying this permission. This object contains both static workspace variables and runtime variables resolved from 'process.env'. An authenticated attacker with low privileges can exploit this by executing a custom function to leak sensitive information such as JWT secrets, SMTP passwords, and cloud provider keys. The vulnerability is addressed in version 3.1.3.
Affected products
- FlowiseAI flowise <= 3.1.2
Timeline
- 2026-07-29: disclosed: Initial report to vendor
- 2026-08-04: advisory: GitHub Advisory published
- 2026-08-04: patched: Fixed in version 3.1.3