Six Flowise vulnerabilities disclosed in March 2026 exposed missing authentication, unsafe file upload, authorization bypass, account-takeover, mass-assignment, and server-side request forgery paths in versions 3.0.12 and earlier. The project advisories and RAXE Labs analysis say the cluster was fixed in version 3.0.13; the six issues were not all remote-code-execution flaws.
Six vulnerabilities disclosed in March 2026 affected Flowise, the open-source platform for building AI workflows and agents. The issues covered missing authentication, unrestricted file upload, authorization bypass, cross-organization account takeover, mass assignment, and server-side request forgery.
RAXE Labs grouped the advisories as a single access-control and trust-boundary cluster affecting Flowise 3.0.12 and earlier. The Flowise project's GitHub security page records the underlying advisories, while RAXE reports that version 3.0.13 contains the fixes.
What the six issues allowed
Two issues were rated critical. CVE-2026-30824 exposed NVIDIA NIM token and container-management endpoints without authentication. CVE-2026-30821 allowed an unauthenticated user to upload a file with a spoofed MIME type, creating a path to persistent code execution when a malicious server-side file could later be triggered.
The four high-severity issues covered a spoofable internal-request header, cross-organization SSO configuration changes, mass assignment in a leads endpoint, and server-side requests to attacker-selected destinations. Authentication requirements differed across the cluster: three issues required no authentication and three required low-privilege access, according to the published advisories summarized by RAXE.
This is narrower than describing all six as remote-code-execution flaws. Some could enable code execution directly or as part of a chain, while others exposed credentials, authorization boundaries, tenant isolation, or internal network access.
Why the cluster matters
Flowise connects models and agents to credentials, APIs, data stores and external tools. Weak access controls in that orchestration layer can therefore reach beyond the user interface into the services an agent is allowed to use.
For operators, upgrading to a fixed release is the first step. The advisory set also supports checking whether self-hosted instances are internet-accessible, requiring authentication, restricting outbound network access, reviewing stored credentials and monitoring changes to organization or SSO configuration. The retrieved sources did not report active exploitation of this six-issue cluster, so the article does not claim that attacks occurred.
Key Points #
- 1The six-issue cluster affected Flowise 3.0.12 and earlier and was fixed in version 3.0.13.
- 2Two critical issues exposed unauthenticated token or file-upload paths; four high-severity issues affected authorization, tenant isolation, mass assignment, and SSRF.
- 3The six vulnerabilities were not all RCE flaws, and the retrieved sources did not establish active exploitation of this cluster.
Scoring Rationale #
The cluster affected an AI workflow platform that can hold credentials and connect to enterprise services. Its mix of unauthenticated and low-privilege paths creates material server, tenant-isolation, and internal-network risk, while the article avoids overstating every issue as RCE.
Sources #
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.