CVE-2026-41273— Flowise 访问控制错误漏洞
Possible ATT&CK Techniques 1AI
T1552.004 · Private Keys新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-41273の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow
ソース: NVD (National Vulnerability Database)
脆弱性説明
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow. By accessing a public chatflow configuration endpoint, an attacker can retrieve internal workflow data, including OAuth credential identifiers, which can then be used to refresh and obtain valid OAuth 2.0 access tokens without authentication. This vulnerability is fixed in 3.1.0.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
关键功能的认证机制缺失
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Flowise 访问控制错误漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Flowise是FlowiseAI开源的一个用于轻松构建 LLM 应用程序的工具。 Flowise 3.1.0之前版本存在访问控制错误漏洞，该漏洞源于认证绕过漏洞，允许未经身份验证的攻击者获取与公共聊天流关联的OAuth 2.0访问令牌。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-41273の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-41273のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-41273 厂商安全公告 (1)
Same Patch Batch · FlowiseAI · 2026-04-23 · 18 CVEs total
| CVE-2026-41267 | 8.1 HIGH | Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organizatio |
| CVE-2026-41272 | 7.1 HIGH | Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) |
| CVE-2026-41270 | 7.1 HIGH | Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function S |
| CVE-2026-41269 | 7.1 HIGH | Flowise: File Upload Validation Bypass in createAttachment |
| CVE-2026-41268 | Flowise: Flowise Parameter Override Bypass Remote Command Execution | |
| CVE-2026-41274 | Flowise: Cypher Injection in GraphCypherQAChain | |
| CVE-2026-41277 | Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object | |
| CVE-2026-41264 | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | |
| CVE-2026-41137 | Flowise: Code Injection in CSVAgent leads to Authenticated RCE | |
| CVE-2026-41138 | Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input v | |
| CVE-2026-41279 | Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credi | |
| CVE-2026-41278 | Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API key | |
| CVE-2026-41275 | Flowise: Password Reset Link Sent Over Unsecured HTTP | |
| CVE-2026-41265 | Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability | |
| CVE-2026-41266 | Flowise: Sensitive Data Leak in public-chatbotConfig | |
| CVE-2026-41276 | Flowise: AccountService resetPassword Authentication Bypass Vulnerability | |
| CVE-2026-41271 | Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains |
IV. 関連脆弱性
同じ製品: Flowise
- CVE-2026-56273
Flowise - Path Traversal in Vector Store basePath Parameter - CVE-2026-56278
Flowise - Session Hijacking via Weak Default Express Session - CVE-2026-56277
Flowise - Hardcoded CORS Wildcard in TTS Endpoint - CVE-2026-58057
Flowise - Custom MCP Environment Variable Denylist Bypass vi - CVE-2025-71336
Flowise - Unsandboxed Remote Code Execution via Custom MCP
同じベンダー: FlowiseAI
- CVE-2026-12821
FlowiseAI Flowise S3 Document Loader S3.ts path traversal - CVE-2026-46480
Flowise: Evaluator create+update mass-assignment allows cros - CVE-2026-46479
Flowise: Evaluation create+update mass-assignment allows cro - CVE-2026-46478
Flowise: DatasetRow create+update mass-assignment allows cro - CVE-2026-46477
Flowise: Dataset create+update mass-assignment allows cross-
同じ弱点: CWE-306
- CVE-2026-58123
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API - CVE-2026-55605
@arikusi/deepseek-mcp-server Missing Authentication on Self- - CVE-2026-0283
PAN-OS: Authentication Bypass Vulnerability in Large Scale V - CVE-2026-59148
Mockoon: Unauthenticated admin API + wildcard CORS allows mo - CVE-2026-61344
Superior Court of California Hearing Reminder Service unauth
V. CVE-2026-41273へのコメント
まだコメントはありません