{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/flowise-3.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-69252"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flowise (3.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eFlowise versions 3.1.2 and earlier contain a broken access control vulnerability (CVE-2026-69252) in the \u003ccode\u003e/api/v1/files\u003c/code\u003e endpoint. The application fails to verify workspace-level permissions, only checking for a general feature flag. Consequently, any authenticated API key - regardless of assigned role - can list and delete files stored in any workspace belonging to the same organization. An attacker with a restricted API key can exfiltrate metadata about files in other workspaces or permanently delete sensitive assets, effectively bypassing the organization's intended workspace isolation boundaries.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates or obtains an API key with minimal permissions (e.g., \u003ccode\u003etools:view\u003c/code\u003e) via legitimate account access.\u003c/li\u003e\n\u003cli\u003eAttacker inspects the \u003ccode\u003e/api/v1/files\u003c/code\u003e endpoint to identify accessible file paths.\u003c/li\u003e\n\u003cli\u003eAttacker sends a \u003ccode\u003eGET\u003c/code\u003e request to \u003ccode\u003e/api/v1/files\u003c/code\u003e using their low-privileged \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e token.\u003c/li\u003e\n\u003cli\u003eThe application logic fails to check \u003ccode\u003eactiveWorkspaceId\u003c/code\u003e, returning a list of all files across the entire organization.\u003c/li\u003e\n\u003cli\u003eAttacker parses the JSON response to extract paths belonging to target workspaces.\u003c/li\u003e\n\u003cli\u003eAttacker sends a \u003ccode\u003eDELETE\u003c/code\u003e request to \u003ccode\u003e/api/v1/files\u003c/code\u003e with the \u003ccode\u003epath\u003c/code\u003e parameter set to a file located in a foreign workspace.\u003c/li\u003e\n\u003cli\u003eThe application performs the deletion using the organization ID context, successfully removing the unauthorized file.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized exposure of file metadata and destructive tampering of workspace data. An attacker can systematically delete files across an entire organization, leading to significant data loss and disruption of business processes for affected users and workspaces.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Flowise to a version where CVE-2026-69252 is patched.\u003c/li\u003e\n\u003cli\u003eImplement request monitoring for the \u003ccode\u003e/api/v1/files\u003c/code\u003e endpoint to identify users accessing paths outside their assigned workspace directory.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect unauthorized file deletion attempts by low-privileged API keys.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-04T17:25:05Z","date_published":"2026-08-04T17:25:05Z","id":"https://feed.craftedsignal.io/briefs/2026-08-flowise-broken-access-control/","summary":"A broken access control vulnerability in Flowise versions 3.1.2 and earlier allows authenticated users with low-privileged API keys to list and delete files across different workspaces within the same organization.","title":"Flowise Broken Access Control in /api/v1/files","url":"https://feed.craftedsignal.io/briefs/2026-08-flowise-broken-access-control/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2025-8943"},{"id":"CVE-2026-69263"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flowise (3.1.2)","Flowise Components (3.1.2)","Flowise","Flowise (\u003c= 3.1.2)","flowise-components"],"_cs_severities":["critical"],"_cs_tags":["rce","injection","flowise","cve-2026-69263","python-injection","authentication-bypass","oauth","cve-2026-70478","web-vulnerability","broken-access-control","oauth2","arbitrary-file-write","path-traversal","privilege-escalation","web-application","secrets-disclosure"],"_cs_type":"advisory","_cs_vendors":["Flowise","FlowiseAI"],"content_html":"\u003cp\u003eFlowise (v3.1.2 and earlier) contains a critical security flaw involving an incomplete environment variable blocklist, identified as CVE-2026-69263. This vulnerability allows an attacker to bypass the intended security controls for the Model Context Protocol (MCP) server configuration, specifically those established in the previous CVE-2025-8943 patch. While the original patch successfully filtered dangerous CLI flags like \u003ccode\u003e-y\u003c/code\u003e for \u003ccode\u003enpx\u003c/code\u003e, it failed to account for \u003ccode\u003enpm\u003c/code\u003e configuration that can be passed via environment variables (e.g., \u003ccode\u003enpm_config_yes\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eBecause Flowise defaults to an unauthenticated state, a remote attacker can interact with the API to register a malicious MCP server. By including specific environment variables in the configuration, an attacker can influence the behavior of \u003ccode\u003enpx\u003c/code\u003e, \u003ccode\u003enode\u003c/code\u003e, or \u003ccode\u003epython3\u003c/code\u003e to achieve remote code execution. This is a classic case of incomplete denylisting, where developers attempted to enumerate dangerous inputs rather than implementing a secure allowlist, leaving the environment vulnerable to various configuration injection vectors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker discovers an internet-facing, unauthenticated Flowise instance.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the Flowise API to create or update an MCP server configuration.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a JSON payload containing the \u003ccode\u003emcpServers\u003c/code\u003e object with a command like \u003ccode\u003enpx\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker inserts environment variables such as \u003ccode\u003enpm_config_yes=true\u003c/code\u003e into the \u003ccode\u003eenv\u003c/code\u003e field of the payload.\u003c/li\u003e\n\u003cli\u003eFlowise validation logic (\u003ccode\u003evalidateCommandFlags\u003c/code\u003e) is bypassed because the CLI flags are clean.\u003c/li\u003e\n\u003cli\u003eFlowise validation logic (\u003ccode\u003evalidateEnvironmentVariables\u003c/code\u003e) is bypassed because the blocklist only contains four hardcoded entries (PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS).\u003c/li\u003e\n\u003cli\u003eFlowise spawns the \u003ccode\u003enpx\u003c/code\u003e process, which reads the injected environment variable and proceeds with automatic package installation.\u003c/li\u003e\n\u003cli\u003eMalicious code is executed under the privileges of the Flowise process, resulting in full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthenticated remote code execution on the server running Flowise. Given the tool's nature as an LLM integration platform, successful compromise often grants an attacker access to connected sensitive data, API keys for AI providers, and internal network resources. All versions up to and including 3.1.2 are confirmed to be vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to a version of Flowise that implements an allowlist-based validation approach for environment variables rather than a denylist.\u003c/li\u003e\n\u003cli\u003eImplement strict authentication on all Flowise API endpoints to prevent unauthenticated access to configuration interfaces.\u003c/li\u003e\n\u003cli\u003eRestrict outbound network access for the server running Flowise to prevent the automatic installation of arbitrary npm/pip packages from the internet.\u003c/li\u003e\n\u003cli\u003eEnsure that the service account running the Flowise process operates with the principle of least privilege, minimizing the damage from a successful code execution event.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-04T19:40:48Z","date_published":"2026-08-04T17:24:33Z","id":"https://feed.craftedsignal.io/briefs/2026-08-flowise-rce/","summary":"Flowise v3.1.2 and earlier are vulnerable to unauthenticated remote code execution because the CVE-2025-8943 patch relies on an incomplete environment variable blocklist, allowing attackers to inject configuration variables that force arbitrary package installation.","title":"Flowise Unauthenticated RCE via Environment Variable Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-flowise-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Flowise (3.1.2)","version":"https://jsonfeed.org/version/1.1"}