highCVE-2026-70471Aug 4, 2026

CVE-2026-70471: Flowise RBAC Bypass Leading to Workspace Variables Disclosure

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A low-privilege Flowise user can call the custom-function execution endpoint to read all workspace variables, including secrets resolved from server environment variables, even when their role…

Packageflowise
Ecosystemnpm
Affected<= 3.1.2
Fixed in3.1.3
CVE-2026-70471: Flowise RBAC Bypass Leading to Workspace Variables Disclosure

The problem

Flowise enforces the variables:view permission correctly on the dedicated /api/v1/variables route, but skips that check entirely when loading variables for the /api/v1/node-custom-function endpoint.

Before executing user-supplied JavaScript, utils.ts fetches every variable in the active workspace and injects them into the sandbox as $vars. Static variables land as their stored values; runtime variables are resolved live from process.env. Any authenticated API key holder, regardless of RBAC role, can call this endpoint and read the full $vars map, potentially exposing database passwords, JWT secrets, cloud API keys, or SMTP credentials.

Proof of concept

A working proof-of-concept for CVE-2026-70471 in flowise, with the exact payload below.

http
POST /api/v1/node-custom-function HTTP/1.1
Host: <flowise-host>
Authorization: Bearer <low-privilege-api-key>
Content-Type: application/json

{
  "javascriptFunction": "return $vars;",
  "functionInputVariables": {}
}

The root cause (CWE-862, Missing Authorization) is that utils.ts:932 fetches all workspace variables unconditionally, and utils.ts:1782 always populates sandbox['$vars'] before handing control to user code. There is no call to the variables:view permission check at either site.

The contrast with routes/variables/index.ts:11, which does enforce the permission, shows this is a forgotten authorization gate rather than a design flaw. The fix in 3.1.3 gates $vars injection on the caller holding variables:view, so the sandbox no longer receives the variable map for unauthorized callers.

The fix

Upgrade to Flowise 3.1.3 or later. The patch adds a variables:view authorization check before populating $vars in the custom-function sandbox, aligning it with the protection already present on the Variables REST API.

Reported by Check Point Research.

References: [1][2][3]

Related research